Authentication Bypass Vulnerability Discovered in Kentico Xperience CMS

What changed

A critical vulnerability has been uncovered in the Kentico Xperience CMS that enables authentication bypass through improper handling of empty SHA1 usernames during digest authentication. This flaw allows unauthorized users to gain control over administrative objects, potentially leading to severe security breaches.

The vulnerability affects all versions of Xperience CMS up to and including 13.0.172, making it imperative for users to understand the risks associated with this issue.

Who is affected

Organizations using Kentico Xperience CMS should be aware of the implications of this vulnerability, as it can compromise their administrative functionalities.

The following groups are particularly at risk:

• Kentico Xperience CMS users and administrators.
• Businesses relying on Kentico for content management.
• Developers integrating Kentico into their applications.
• Organizations managing sensitive data through the CMS.

What to do

It is crucial for affected users to take immediate action to mitigate the risks posed by this vulnerability. Ensuring that systems are updated and configured correctly can help prevent unauthorized access.

Recommendations include:

• Update to the latest version of Kentico Xperience CMS as soon as possible.
• Review authentication settings and ensure they comply with best practices.
• Monitor administrative access logs for any suspicious activity.
• Implement additional security measures, such as multi-factor authentication.