Description

Kentico CMS is an ASP.NET web content management system.

The Kentico installation wizard is found in the web application. An attacker can install a new site and get Global Administrator access.

Remediation

Restrict access to the installation wizard

References

CVE-2017–17736

Related Vulnerabilities

WordPress Plugin WP REST API (WP API) Security Bypass (1.2.1)

WordPress Plugin wpCentral Security Bypass (1.4.7)

WordPress Plugin Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, Aweber-MailOptin Security Bypass (1.2.35.1)

WordPress Plugin Live Search for WooCommerce Security Bypass (2.0.2)

WordPress Plugin WP SEO TDK Security Bypass (2.0.2)

Severity

High

Classification

CWE-425 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Insecure Admin Access Authentication Bypass