CVE-2019-25230
BaseFortify
Publication date: 2025-12-18
Last updated on: 2025-12-24
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kentico | xperience | to 12.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-497 | The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that only authenticated users with proper privileges can access the live site widget properties dialog in Kentico Xperience. Apply any available hotfixes or patches provided by Kentico, such as those referenced in Kentico DevNet Hotfixes. Review and tighten access controls to prevent unauthorized access to sensitive system objects. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated users to access sensitive system information without proper access controls, which could lead to unauthorized disclosure of sensitive data. This exposure may impact compliance with standards and regulations such as GDPR and HIPAA that require protection of sensitive information and strict access controls. However, the provided resources do not explicitly discuss compliance implications. [1]
Can you explain this vulnerability to me?
CVE-2019-25230 is an information disclosure vulnerability in Kentico Xperience (up to version 12.0.0) that allows authenticated users to view sensitive system objects through the live site widget properties dialog. This happens because there are insufficient access controls, enabling users with low privileges to access system information they should not be authorized to see. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers or unauthorized users with valid credentials to access sensitive system information. Although the impact on confidentiality is low, this unauthorized access could aid attackers in planning further attacks or exploiting other vulnerabilities within the system. [1]