CVE-2017-17736 is a critical vulnerability affecting Kentico 9.0 (before 9.0.51) and 10.0 (before 10.0.48) that allows remote attackers to gain Global Administrator access. This unauthenticated flaw, with a CVSS score of 9.8, enables full compromise of the system by simply visiting the install page and then the administration dashboard. While there is no evidence of active exploitation in the wild or Metasploit modules, a Nuclei template exists, and the vulnerability has a high EPSS score indicating exploitability, despite minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 9.0, < 9.0.51CPE matchmatch criteria | cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:* | ||
>= 10.0, < 10.0.48CPE matchmatch criteria | cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.