Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability

Mô tả

Tham khảo

• devnet.kentico.com/download/hotfixes · Patch
• watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011 · Third Party Advisory
• labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms · Exploit
• vulncheck.com/advisories/kentico-xperience-staging-sync-server-none-password-type-authentication-bypass · Third Party Advisory
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
• CISA KEV · CVE-2025-2747

Lỗ hổng khác của xperience

• CVE-2025-5591TRUNG BÌNH 5.4Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim use…
• CVE-2024-58323TRUNG BÌNH 5.4A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Checkbox form componen…
• CVE-2024-58322TRUNG BÌNH 5.4A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious code into shipping options configurati…
• CVE-2024-58321TRUNG BÌNH 5.4A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form validation rule confi…
• CVE-2024-58320TRUNG BÌNH 5.3An information disclosure vulnerability in Kentico Xperience allows public users to access sensitive administration interface hostname detai…