Test ID:	1.3.6.1.4.1.25623.1.0.113366
Category:	Web application abuses
Title:	Kentico CMS <= 12.0.14 RCE Vulnerability
Summary:	Kentico CMS is prone to a remote code execution (RCE); vulnerability.
Description:	Summary: Kentico CMS is prone to a remote code execution (RCE) vulnerability. Vulnerability Insight: Due to a failure to validate security headers, it's possible for a specially crafted request to the staging service to bypass initial authentication and proceed to deserialize user-controlled .NET object input. This deserialization then leads to unauthenticated remote code execution on the server where the Kentico instance is hosted. Vulnerability Impact: Successful exploitation would allow an attacker to execute arbitrary code on the target system. Affected Software/OS: Kentico CMS prior to version 12.0.15. This vulnerability only exists if the Staging Service authentication is not set to X.509. Solution: Update to version 12.0.15 or later. Note: Please create an override for this result if the hotfix has been applied. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2019-10068 http://packetstormsecurity.com/files/157588/Kentico-CMS-12.0.14-Remote-Command-Execution.html https://devnet.kentico.com/download/hotfixes#securityBugs-v12
Copyright	Copyright (C) 2019 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.