CVE-2022-29287 - CVE House
Back to Database
Status published Medium CVE-2022-29287

Kentico CMS before 13.0.66 has an Insecure Direct Object Reference...

Vulnerability Description

Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability. It allows an attacker with user management rights (default is Administrator) to export the user options of any user, even ones with higher privileges (like Global Administrators) than the current user. The exported XML contains every option of the exported user (even the hashed password).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-29287

Credits & Attribution

No credits recorded in the NVD database.

References

More from kentico

View All →
CVE-2022-32387
In Kentico before 13.0.66, attackers can achieve Denial of Service...
High 7.5
CVE-2021-46163
Kentico Xperience 13.0.44 allows XSS via an XML document to...
Medium 6.1
CVE-2021-27581
The Blog module in Kentico CMS 5.5 R2 build 5.5.3996...
Critical 9.8
CVE-2020-24794
Cross Site Scripting (XSS) vulnerability in Kentico before 12.0.75....
Medium 6.1
CVE-2019-6242
Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP...
High 7.2

Affected Vendor

Affected Software

xperience
Vulnerable Versions:
0

Timeline

Official Publish: April 15th, 2022
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:H/S:U/UI:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.