CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
5.2 | $0-$5k | 0.00 |
A vulnerability was found in Kentico CMS up to 10.0.49/11.0.4 (Content Management System). It has been declared as critical. This vulnerability affects an unknown functionality of the component Administration Interface. The manipulation with an unknown input leads to a sql injection vulnerability. The CWE definition for the vulnerability is CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:
Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface.
The bug was discovered 01/09/2018. The weakness was released 03/19/2018 (GitHub Repository). The advisory is available at gist.github.com. This vulnerability was named CVE-2018-6843 since 02/07/2018. The exploitation appears to be easy. The attack can be initiated remotely. The successful exploitation needs a single authentication. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1505 by the MITRE ATT&CK project.
The vulnerability was handled as a non-public zero-day exploit for at least 69 days. During that time the estimated underground price was around $0-$5k.
Upgrading to version 10.0.50 or 11.0.3 eliminates this vulnerability.
Entry connected to this vulnerability is available at 114765.
Product
Type
Vendor
Name
Version
- 10.0.0
- 10.0.1
- 10.0.2
- 10.0.3
- 10.0.4
- 10.0.5
- 10.0.6
- 10.0.7
- 10.0.8
- 10.0.9
- 10.0.10
- 10.0.11
- 10.0.12
- 10.0.13
- 10.0.14
- 10.0.15
- 10.0.16
- 10.0.17
- 10.0.18
- 10.0.19
- 10.0.20
- 10.0.21
- 10.0.22
- 10.0.23
- 10.0.24
- 10.0.25
- 10.0.26
- 10.0.27
- 10.0.28
- 10.0.29
- 10.0.30
- 10.0.31
- 10.0.32
- 10.0.33
- 10.0.34
- 10.0.35
- 10.0.36
- 10.0.37
- 10.0.38
- 10.0.39
- 10.0.40
- 10.0.41
- 10.0.42
- 10.0.43
- 10.0.44
- 10.0.45
- 10.0.46
- 10.0.47
- 10.0.48
- 10.0.49
- 11.0.0
- 11.0.1
- 11.0.2
- 11.0.3
- 11.0.4
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 5.9VulDB Meta Temp Score: 5.7
VulDB Base Score: 4.7
VulDB Temp Score: 4.2
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 7.2
NVD Vector: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Sql injectionCWE: CWE-89 / CWE-74 / CWE-707
ATT&CK: T1505
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: CMS 10.0.50/11.0.3
Timeline
01/09/2018 🔍02/07/2018 🔍
03/19/2018 🔍
03/19/2018 🔍
03/19/2018 🔍
05/28/2020 🔍
Sources
Advisory: gist.github.comStatus: Not defined
CVE: CVE-2018-6843 (🔍)
See also: 🔍
Entry
Created: 03/19/2018 20:35Updated: 05/28/2020 20:28
Changes: 03/19/2018 20:35 (59), 05/28/2020 20:28 (2)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.