CVE-2019-10068: Kentico Xperience Deserialization of Untrusted Data Vulnerability
Kentico contains a failure to validate security headers. This deserialization can led to unauthenticated remote code execution.
Other sources
An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to deserialize user-controlled .NET object input. This deserialization then led to unauthenticated remote code execution on the server where the Kentico instance was hosted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kentico CMSto a version that resolves this vulnerability.Fixed in 12.0.15 - Upgrade
Upgrade
Kentico CMSto a version that resolves this vulnerability.Fixed in 11.0.48 - Upgrade
Upgrade
Kentico CMSto a version that resolves this vulnerability.Fixed in 10.0.52 - Compensating control
Restrict access to the Kentico staging service to trusted IP addresses and internal networks using firewall rules or network ACLs (disable or block external/public access to the staging service) until a fixed version is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10068?
CVE-2019-10068 is rated as critical due to the potential for unauthenticated remote code execution.
How do I fix CVE-2019-10068?
To fix CVE-2019-10068, upgrade to Kentico versions 12.0.15 or later, 11.0.48 or later, 10.0.52 or later, or 9.0.51 or later.
What systems are vulnerable to CVE-2019-10068?
CVE-2019-10068 affects Kentico versions prior to 12.0.15, 11.0.48, 10.0.52, and 9.x before 9.0.51.
What type of vulnerability is CVE-2019-10068?
CVE-2019-10068 is a vulnerability related to the failure to validate security headers, leading to possible deserialization issues.
Who is affected by CVE-2019-10068?
Organizations using vulnerable versions of Kentico CMS are at risk from CVE-2019-10068, particularly if they have not applied necessary updates.