S4E just found a high-severity finding from top 10 tcp port service scan
PlatformPlansPartners
Resources
ToolsBlogDocs
Labs
CVE ForecastOpservantAll Research →
Sign Up →
critical·Product Based Web Vulnerabilities·Updated Dec 16, 2023

CVE-2019-10068 Scanner

Detects 'Deserialization of Untrusted Data' vulnerability in Kentico CMS affects v. 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x.

Est. Time~15 seconds
Scan TypeSingle Scan
Targetsurl
CostFree
2k
Times Used
continuous scan runs
3.4k
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
🔴
CISA Known Exploited Vulnerability
This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.
9.8
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description

An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to deserialize user-controlled .NET object input. This deserialization then led to unauthenticated remote code execution on the server where the Kentico instance was hosted.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
n/aby n/a
n/a
Updated Oct 12, 2026View on NVD →
Detail

Kentico CMS is a popular web content management system used by many businesses worldwide. With Kentico, website owners can design, manage and promote their web content with ease. The software provides many features, including content editing, marketing and e-commerce capabilities, and site analytics. Additionally, Kentico is highly scalable, making it an ideal choice for businesses of all sizes.

CVE-2019-10068 is a vulnerability that was discovered in Kentico versions 9.x through 12.0.x. The vulnerability arises from a failure to validate security headers. This loophole makes it possible for an attacker to craft a request to the staging service and bypass the initial security checks. After that, a specially crafted, unauthenticated .NET object input can be used to execute remote code on the Kentico server.

Exploiting this vulnerability puts the entire site at risk. An attacker can execute arbitrary code on the server that could result in unauthorized access to its data, compromising user privacy, and potentially damaging the reputation of the affected business. Additionally, the attack opens up the site to other types of attacks, such as advanced persistent threats, that further endanger the company's digital assets.

Thanks to pro features provided by the Security Foreveryone.com platform, website owners can stay informed about vulnerabilities like CVE-2019-10068 in their digital assets. Security Foreveryone.com provides comprehensive vulnerability detection, management and mitigation solutions that protect businesses from cyber threats. By using this platform, website owners can have peace of mind, knowing that their digital assets and online reputation are secure.

 

REFERENCES

Solution Advice

Businesses can protect themselves against this vulnerability by taking the following precautions:

  • Apply all the latest patches provided by Kentico software.
  • Implement proper network segmentation.
  • Implement robust password policies, with frequent password changes.
  • Regularly review access preferences to ensure adherence to the least privilege principle.
  • Limit the type of data allowed within the deserialization process.

Get AI-powered remediation steps tailored to your asset.

Try AI Solutions →
Similar Tools
medium
CVE-2012-4768 Scanner
→critical
CVE-2021-34187 Scanner
→high
CVE-2021-21315 Scanner
→high
CVE-2020-13379 Scanner
→high
CVE-2023-37462 Scanner
→medium
CVE-2021-21087 Scanner
→high
CVE-2023-24243 Scanner
→high
CVE-2017-0929 Scanner
→

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.