CVE-2019-25229
BaseFortify
Publication date: 2025-12-18
Last updated on: 2025-12-24
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kentico | xperience | to 12.0.29 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2019-25229 is an unrestricted file upload vulnerability in Kentico Xperience's MVC form file uploader components. It allows authenticated users with only 'Read data' permissions to upload arbitrary file types by manipulating file names. This means attackers can upload potentially malicious files to the system without proper restrictions, leading to unauthorized file uploads. [1]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized file uploads of potentially malicious files, which can compromise the system's confidentiality, integrity, and availability. Attackers could exploit this to execute malicious code, disrupt services, or gain further unauthorized access, posing significant security risks. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should apply the security updates or hotfixes provided by the Kentico Security Team for Kentico Xperience versions up to and including 12.0.29. Restrict or review permissions to ensure that users with 'Read data' permissions cannot upload files, and monitor or disable the MVC form file uploader components if possible until patched. [1]