CVE-2017-17736 Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashbo...
CriticalCVSS 9.8
EPSS 68.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Kentico Xperience | >= 9.0, < 9.0.51 | 9.0.51 |
| Kentico Xperience | >= 10.0, < 10.0.48 | 10.0.48 |
References
- blog.hivint.com exploit third-party-advisory