CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2019-03-26
Kentico CMS Staging Service Authentication Bypass and .NET Deserialization Remote Code Execution (RCE) (CVE-2019-10068)
[Affected Scope] Kentico CMS versions 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and all 9.x versions
[Impact] Unauthenticated remote attackers can bypass authentication and execute arbitrary .NET object deserialization, leading to full remote code execution on the host server
[Mitigation] Immediately apply the official vendor hotfixes or restrict external network access to the Kentico Staging Service endpoints