CVE-2019-12102 json
Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselec…
published 2019-05-22 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-3754
- cvss
- 9.1
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.4%
- EPSS 2.4% chance of exploitation in 30 days, percentile 84%
- public exploits
- 0
- none known
Summary
Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabs_media.aspx URI. NOTE: The vendor disputes the report because the researcher did not configure the media library permissions correctly. The vendor states that by default all users can read/modify/upload files, and it’s up to the administrator to decide who should have access to the media library and set the permissions accordingly. See the vendor documentation in the references for more information
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
2.42% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 9.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Classification
- Weakness
-
- CWE-732 Incorrect Permission Assignment for Critical Resource
References
-
docs.kentico.com
/k12/release-notes-kentico-12
release-notes, vendor-advisory
-
devnet.kentico.com
/download/hotfixes
vendor-advisory
-
github.com
/Gr4y21/My-CVE-IDs/blob/master/Kentico%20CMS%20Unauthenticated%20File%20Upload%20and%20File%20Exposure
broken-link
- docs.kentico.com /k12/configuring-kentico/configuring-the-environment-for-content-editors/configuring-media-libraries/assigning
Sources
- CVE List CVE-2019-12102
- NVD CVE-2019-12102
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.