CVE-2019-12102

Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabs_media.aspx URI. NOTE: The vendor disputes the report because the researcher did not configure the media library permissions correctly. The vendor states that by default all users can read/modify/upload files, and it’s up to the administrator to decide who should have access to the media library and set the permissions accordingly. See the vendor documentation in the references for more information

• CWE-732

• https://devnet.kentico.com/download/hotfixesVendor Advisory
• https://docs.kentico.com/k12/configuring-kentico/configuring-the-environment-for-content-editors/configuring-media-libraries/assigning-permissions-to-media-libraries
• https://docs.kentico.com/k12/release-notes-kentico-12Release Notes, Vendor Advisory
• https://github.com/Gr4y21/My-CVE-IDs/blob/master/Kentico%20CMS%20Unauthenticated%20File%20Upload%20and%20File%20ExposureBroken Link
• https://devnet.kentico.com/download/hotfixesVendor Advisory
• https://docs.kentico.com/k12/configuring-kentico/configuring-the-environment-for-content-editors/configuring-media-libraries/assigning-permissions-to-media-libraries
• https://docs.kentico.com/k12/release-notes-kentico-12Release Notes, Vendor Advisory
• https://github.com/Gr4y21/My-CVE-IDs/blob/master/Kentico%20CMS%20Unauthenticated%20File%20Upload%20and%20File%20ExposureBroken Link

Published

May 22, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12095Horde Trean, as used in Horde Groupware Webmail Edition thro…8.8
• CVE-2019-12097Telerik Fiddler v5.0.20182.28034 doesn't verify the hash of …
• CVE-2019-12098In the client side of Heimdal before 7.6.0, failure to verif…7.4
• CVE-2019-12099In PHP-Fusion 9.03.00, edit_profile.php allows remote authen…
• CVE-2019-1210Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-12101coap_decode_option in coap.c in LibNyoci 0.07.00rc1 mishandl…
• CVE-2019-12103The web-based configuration interface of the TP-Link M7350 V…
• CVE-2019-12104The web-based configuration interface of the TP-Link M7350 V…
• CVE-2019-12105In Supervisor through 4.0.2, an unauthenticated user can rea…8.2
• CVE-2019-12106The updateDevice function in minissdpd.c in MiniUPnP MiniSSD…
• CVE-2019-12107The upnp_event_prepare function in upnpevents.c in MiniUPnP …
• CVE-2019-12108A Denial Of Service vulnerability in MiniUPnP MiniUPnPd thro…