CVE-2018-5282 - CVE House
Back to Database
Status published High CVE-2018-5282

Kentico 9.0 through 11.0 has a stack-based buffer overflow via...

Vulnerability Description

Kentico 9.0 through 11.0 has a stack-based buffer overflow via the SqlName, SqlPswd, Database, UserName, or Password field in a SilentInstall XML document. NOTE: the vendor disputes this issue because neither a buffer overflow nor a crash can be reproduced; also, reading XML documents is implemented exclusively with managed code within the Microsoft .NET Framework

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-5282

Credits & Attribution

No credits recorded in the NVD database.

References

More from kentico

View All →
CVE-2022-32387
In Kentico before 13.0.66, attackers can achieve Denial of Service...
High 7.5
CVE-2022-29287
Kentico CMS before 13.0.66 has an Insecure Direct Object Reference...
Medium 4.9
CVE-2021-46163
Kentico Xperience 13.0.44 allows XSS via an XML document to...
Medium 6.1
CVE-2021-27581
The Blog module in Kentico CMS 5.5 R2 build 5.5.3996...
Critical 9.8
CVE-2020-24794
Cross Site Scripting (XSS) vulnerability in Kentico before 12.0.75....
Medium 6.1

Affected Vendor

Affected Software

xperience
Vulnerable Versions:
9.0

Timeline

Official Publish: January 8th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.