Critical · published March 24, 2025
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.5th percentile for exploit probability.
🚨 An empty SHA1 username is all it takes to waltz past authentication in Kentico Xperience! This vulnerability opens the door for attackers to seize control of administrative objects - a disaster waiting to happen! 🔥 Think of it like a restaurant where anyone can walk through the staff entrance if they simply use a blank employee badge. The lack of proper checks means anyone can access the kitchen and change the menu without a second thought. This critical vulnerability allows an attacker to bypass authentication entirely, gaining unauthorized control over administrative functions. This means they could wreak havoc by altering site settings, stealing sensitive data, or even shutting down entire services — absolutely devastating for any organization relying on Kentico Xperience!
Think of it like a restaurant where anyone can walk through the staff entrance if they simply use a blank employee badge. The lack of proper checks means anyone can access the kitchen and change the menu without a second thought. The vulnerability stems from how the Staging Sync Server handles SHA1 usernames during digest authentication. When a username is empty, the system fails to enforce proper authentication checks, allowing unverified access.
This critical vulnerability allows an attacker to bypass authentication entirely, gaining unauthorized control over administrative functions. This means they could wreak havoc by altering site settings, stealing sensitive data, or even shutting down entire services — absolutely devastating for any organization relying on Kentico Xperience! To secure your system, immediately upgrade to a patched version beyond 13.0.172. Ensure your authentication mechanisms are properly configured to reject empty usernames and conduct a thorough security audit of your deployment. Don't take chances! You've got this! With these steps, you'll lock down your Kentico Xperience like a pro. 🛡️