Kentico CMS up to 11.0.44 File Upload unrestricted upload

Summaryinfo

A vulnerability, which was classified as critical, was found in Kentico CMS up to 11.0.44. This impacts an unknown function of the component File Upload. The manipulation results in unrestricted upload. This vulnerability is identified as CVE-2018-19453. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Kentico CMS up to 11.0.44 (Content Management System). It has been classified as critical. Affected is some unknown functionality of the component File Upload. The manipulation with an unknown input leads to a unrestricted upload vulnerability. CWE is classifying the issue as CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Kentico CMS before 11.0.45 allows unrestricted upload of a file with a dangerous type.

The weakness was released 04/10/2019. This vulnerability is traded as CVE-2018-19453 since 11/22/2018. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1608.002.

Upgrading to version 11.0.45 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Content Management System

Vendor

• Kentico

Name

• CMS

Version

• 11.0.0
• 11.0.1
• 11.0.2
• 11.0.3
• 11.0.4
• 11.0.5
• 11.0.6
• 11.0.7
• 11.0.8
• 11.0.9
• 11.0.10
• 11.0.11
• 11.0.12
• 11.0.13
• 11.0.14
• 11.0.15
• 11.0.16
• 11.0.17
• 11.0.18
• 11.0.19
• 11.0.20
• 11.0.21
• 11.0.22
• 11.0.23
• 11.0.24
• 11.0.25
• 11.0.26
• 11.0.27
• 11.0.28
• 11.0.29
• 11.0.30
• 11.0.31
• 11.0.32
• 11.0.33
• 11.0.34
• 11.0.35
• 11.0.36
• 11.0.37
• 11.0.38
• 11.0.39
• 11.0.40
• 11.0.41
• 11.0.42
• 11.0.43
• 11.0.44

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion