CVE-2018-7046 - CVE House
Back to Database
Status published High CVE-2018-7046

Arbitrary code execution vulnerability in Kentico 9 through 11 allows...

Vulnerability Description

Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary operating system commands in a dynamic .NET code evaluation context via C# code in a "Pages -> Edit -> Template -> Edit template properties -> Layout" box. NOTE: the vendor has responded that there is intended functionality for authorized users to edit and update ascx code layout

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-7046

Credits & Attribution

No credits recorded in the NVD database.

References

More from kentico

View All →
CVE-2022-32387
In Kentico before 13.0.66, attackers can achieve Denial of Service...
High 7.5
CVE-2022-29287
Kentico CMS before 13.0.66 has an Insecure Direct Object Reference...
Medium 4.9
CVE-2021-46163
Kentico Xperience 13.0.44 allows XSS via an XML document to...
Medium 6.1
CVE-2021-27581
The Blog module in Kentico CMS 5.5 R2 build 5.5.3996...
Critical 9.8
CVE-2020-24794
Cross Site Scripting (XSS) vulnerability in Kentico before 12.0.75....
Medium 6.1

Affected Vendor

Affected Software

xperience
Vulnerable Versions:
9.0

Timeline

Official Publish: February 20th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.