CVE-2022-29287

Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability. It allows an attacker with user management rights (default is Administrator) to export the user options of any user, even ones with higher privileges (like Global Administrators) than the current user. The exported XML contains every option of the exported user (even the hashed password).

• CWE-639

• https://devnet.kentico.com/download/hotfixesRelease Notes, Vendor Advisory
• https://www.offensity.com/en/blog/authenticated-insecure-direct-object-reference-in-kentico-cms-cve-outstanding/Exploit, Third Party Advisory
• https://devnet.kentico.com/download/hotfixesRelease Notes, Vendor Advisory
• https://www.offensity.com/en/blog/authenticated-insecure-direct-object-reference-in-kentico-cms-cve-outstanding/Exploit, Third Party Advisory

Published

Apr 16, 2022

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29278Incorrect pointer checks within the NvmExpressDxe driver can…8.2
• CVE-2022-29279Use of a untrusted pointer allows tampering with SMRAM and O…8.2
• CVE-2022-2928In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R…6.5
• CVE-2022-29280Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-29281Notable before 1.9.0-beta.8 doesn't effectively prevent the …8.8
• CVE-2022-29286Pexip Infinity 27 before 28.0 allows remote attackers to tri…7.5
• CVE-2022-2929In ISC DHCP 1.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16…6.5
• CVE-2022-29296A reflected cross-site scripting (XSS) vulnerability in the …6.1
• CVE-2022-29298SolarView Compact ver.6.00 allows attackers to access sensit…7.5
• CVE-2022-29299Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-2930Unverified Password Change in GitHub repository octoprint/oc…7.8
• CVE-2022-29301Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…