SMTP Password Exposure in Kentico Products by Kentico Software
CVE-2019-6242

7.2HIGH

Key Information:

Vendor

Kentico

Status
Kentico
Vendor
CVE Published:
8 February 2019

What is CVE-2019-6242?

In Kentico version 10.0.42, a configuration issue allows Global Administrators to access the cleartext SMTP password by visiting the SMTP configuration page. While the vendor treats this scenario as a best-practice violation rather than a traditional vulnerability, it can lead to significant security risks if exploited. The vendor has acknowledged the issue and plans to implement a fix in a future update, highlighting the need for heightened security measures in application management.

References

https://gist.github.com/boatpavaris/cff51e52a96fdde8215f7...
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.