Kentico Xperience Cookie Security Configuration Vulnerability Allowing SSL Bypass

A vulnerability in Kentico Xperience in versions through 13.0.164 allows attackers to bypass SSL requirements for administration cookies, potentially compromising session security and authentication. This issue arises from incorrect handling of the 'requireSSL' attribute in .NET Framework projects, which can lead to sensitive cookies being transmitted without the 'Secure' attribute, leaving them vulnerable to interception.

Impact

Exploitation of this vulnerability could lead to sensitive cookies being transmitted over unencrypted channels, allowing for session hijacking and unauthorized access to administrative functions.

Remediation

Users can upgrade to Kentico Xperience version 13.0.165 or later, where this vulnerability has been addressed. Instructions for applying the hotfix are available on the Kentico Xperience Hotfixes page.