VulnerabilityAnalyzed

CVE-2024-58320

An information disclosure vulnerability in Kentico Xperience allows public users to access sensitive administration interface hostname details during authentication.

MEDIUM 6.9EPSS 0.27%

Does this matter?

Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.

Description

An information disclosure vulnerability in Kentico Xperience allows public users to access sensitive administration interface hostname details during authentication. Attackers can retrieve confidential hostname configuration information through a public endpoint, potentially exposing internal network details.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.27% probability · 19th percentile
CISA KEV: Not listed
Weakness: CWE-497
Affected: kentico/xperience
Source: disclosure@vulncheck.com

References

https://devnet.kentico.com/download/hotfixesProduct
https://www.vulncheck.com/advisories/kentico-xperience-authentication-information-disclosureThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.