Stack-based buffer overflow in Kentico Xperience - CVE-2018-5282
Published: January 16, 2018 / Updated: June 17, 2021
Vulnerability identifier: #VU10027
CSH Severity: Low
CVSS v4: 9.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
CVE-ID: CVE-2018-5282
CWE-ID: CWE-121
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a local attacker to gain elevated privileges on the target system.
The weakness exists due to a stack-based buffer overflow. A local attacker can use SqlName, SqlPswd, Database, UserName, or Password field in a SilentInstall XML document, trigger memory corruption and execute arbitrary code with system privileges.
Successful exploitation of the vulnerability may result in system compromise.
The weakness exists due to a stack-based buffer overflow. A local attacker can use SqlName, SqlPswd, Database, UserName, or Password field in a SilentInstall XML document, trigger memory corruption and execute arbitrary code with system privileges.
Successful exploitation of the vulnerability may result in system compromise.
Affected software
Kentico Xperience
How to mitigate CVE-2018-5282
Install update from vendor's website.