Information Disclosure Vulnerability in Kentico Xperience
CVE-2019-25230

5.3MEDIUM

Key Information:

Vendor

Kentico

Status
Xperience
Vendor
CVE Published:
18 December 2025

What is CVE-2019-25230?

An information disclosure vulnerability in Kentico Xperience enables authenticated users to gain access to sensitive system objects through the live site widget properties dialog. This vulnerability can be exploited by attackers to reveal unauthorized system information, bypassing established access controls and posing a risk to system integrity. It is imperative for users of Kentico Xperience to apply available patches promptly to mitigate this risk.

Affected Version(s)

Xperience 0 <= 12.0.0

References

https://devnet.kentico.com/download/hotfixes
vendor-advisorypatch
https://www.vulncheck.com/advisories/kentico-xperience-us...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kentico Security Team
JSON
.
CVE-2019-25230 : Information Disclosure Vulnerability in Kentico Xperience