← Back

CVE-2025-2747

nvd nistnuclei
Published: Mar 24, 2025Modified: Nov 6, 2025CISA KEV

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: disclosure@vulncheck.com (Secondary)

Description

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.

Affected (1)

Products: Kentico: Xperience
Kentico
1 product
Xperience
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Xperience
Up to 13.0.178

Related CWEs

CWE-288
Authentication Bypass Using an Alternate Path or Channel
A product requires authentication, but the product has an alternate path or channel that does not require authentication.

References (5)

Source: disclosure@vulncheck.com
Patch
Source: disclosure@vulncheck.com
Third Party Advisory
Source: disclosure@vulncheck.com
ExploitThird Party Advisory
Source: disclosure@vulncheck.com
Third Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.