CVE-2018-7046
HIGHKentico Xperience 9.0-11.0 - Authenticated Remote Code Execution via Template Layout C# Code Injection
Title source: llmDescription
Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary operating system commands in a dynamic .NET code evaluation context via C# code in a "Pages -> Edit -> Template -> Edit template properties -> Layout" box. NOTE: the vendor has responded that there is intended functionality for authorized users to edit and update ascx code layout
References (1)
Core 1
Core References
Exploit, Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/541790/100/0/threaded
Scores
CVSS v3
7.2
EPSS
0.0552
EPSS Percentile
91.8%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-78
Status
published
Products (1)
kentico/xperience
9.0 - 11.0
Published
Feb 20, 2018
Tracked Since
Feb 18, 2026