{"basis":"claimed","id":"CVE-2025-2747","name":"Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability","vendorProject":"Kentico","product":"Xperience CMS","publishedAt":"2025-03-24","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"exploited":{"kevAdded":"2025-10-20","dueDate":"2025-11-10","ransomware":false},"epss":{"score":0.97166,"percentile":0.99895,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"blocks","firstOn":"2025-08-11","daysToRule":140},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2026-01-20","daysToRule":302},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass","description":"An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.","cwes":["CWE-288"],"vendors":[{"vendor":"cloudflare","status":"blocks","basis":"claimed","firstOn":"2025-08-11","firstIsNew":true,"daysToRule":140,"daysAtMost":null,"freePlan":false,"claims":[{"id":"ab59b45154c8d66ea12b06f19af87f91a38fca5eff68953d879a5095ee980aac","cve_id":"CVE-2025-2747","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"7dc07014cefa4ce9adf21da7b79037e6","rule_name":"Kentico Xperience CMS - Auth Bypass - CVE:CVE-2025-2747","change":"new","default_action":"Block","published_on":"2025-08-11","source_url":"https://developers.cloudflare.com/changelog/post/2025-08-11-waf-release/","source_title":"WAF Release - 2025-08-11","excerpt":"Kentico Xperience CMS - Auth Bypass - CVE:CVE-2025-2747. Previous action: Log. New action: Block. This is a New Detection","first_seen_at":"2026-11-02T21:00:16.135Z"}]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2026-01-20","firstIsNew":true,"daysToRule":302,"daysAtMost":null,"freePlan":false,"claims":[{"id":"e141a243bc5a44e3490d00261bb36a2be09ded414e20eb51dd937ae105d3832d","cve_id":"CVE-2025-2747","vendor":"f5","product":"Attack signatures","rule_id":"200013149","rule_name":"Kentico Xperience Staging Service Authentication Bypass","change":"new","default_action":null,"published_on":"2026-01-20","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200013149 \"Kentico Xperience Staging Service Authentication Bypass\" (Authentication/Authorization Attacks, risk High), systems: ASP.NET. References: CVE-2025-2747.","first_seen_at":"2026-11-02T21:00:25.080Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T23:17:40.939Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"passed","templateId":"CVE-2025-2747","templatePath":"http/cves/2025/CVE-2025-2747.yaml","requests":1,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"POST","path":"/CMSPages/Staging/SyncServer.asmx","status":200,"blocked":false,"rules":[]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"passed","templateId":"CVE-2025-2747","templatePath":"http/cves/2025/CVE-2025-2747.yaml","requests":1,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"POST","path":"/CMSPages/Staging/SyncServer.asmx","status":200,"blocked":false,"rules":[]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0}],"top_posts":[],"exploit_repositories":[]}}