CVE-2022-29287

Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability

Medium · published April 15, 2022

CVSS v3.1
4.9
EPSS
1%
Percentile
59.2
In the wild
Unconfirmed
What it is

Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability. It allows an attacker with user management rights (default is Administrator) to export the user options of any user, even ones with higher privileges (like Global Administrators) than the current user. The exported XML contains every option of the exported user (even the hashed password).

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:H/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.00897 · 59.2th percentile
Published
2022-04-15T23:52Z
EPSS history
Timeline
  • 15 APR 23:52Z
    Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability
    cvelistv5