Kentico Xperience Information Disclosure Vulnerability in Authentication Process

A vulnerability allowing information disclosure has been identified in Kentico Xperience versions through 13.0.159. This vulnerability allows public users to access sensitive hostname details related to the administration interface during the authentication process. Attackers can exploit this issue to retrieve confidential hostname configuration information through a public endpoint, potentially revealing internal network details.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive system information, specifically administration interface hostname details, which could include internal network information.

Remediation

Users can upgrade to Kentico Xperience version 13.0.160 or later, where this vulnerability has been addressed. Instructions for applying the hotfix are available on the Kentico Xperience DevNet hotfixes page.