fkie_cve-2025-2746
Vulnerability from fkie_nvd
Published
2025-03-24 19:15
Modified
2025-09-23 16:15
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.
References
disclosure@vulncheck.comhttps://devnet.kentico.com/download/hotfixes
disclosure@vulncheck.comhttps://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011
disclosure@vulncheck.comhttps://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/
Impacted products
Vendor Product Version


To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en Kentico Xperience permite omitir la autenticaci\u00f3n mediante la gesti\u00f3n de contrase\u00f1as del servidor de sincronizaci\u00f3n de pruebas de nombres de usuario SHA1 vac\u00edos en la autenticaci\u00f3n impl\u00edcita. Esta omisi\u00f3n de autenticaci\u00f3n permite a un atacante controlar objetos administrativos. Este problema afecta a Xperience hasta la versi\u00f3n 13.0.172."
    }
  ],
  "id": "CVE-2025-2746",
  "lastModified": "2025-09-23T16:15:31.570",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-03-24T19:15:51.460",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://devnet.kentico.com/download/hotfixes"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-288"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.