Cyber Resilience

CVE-2025-32370

Kentico Xperience ≤ 13.0.178

Public PoC
Published
06 April 2025
Modified
08 April 2025
CVSS Score v3.1 7.2
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
EPSS Score 0.015 71th percentile
Risk Priority 57 floored blend · peak EPSS

Summary

CVE-2025-32370 is a high-severity Hidden Functionality (CWE-912) vulnerability in Kentico Xperience. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Redundant Access (T1108); ranked in the top 29% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to CM-2 (Baseline Configuration) and CM-7 (Least Functionality) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProviderSafe, there is additional functionality to create files with other extensions. NOTE: this is a separate issue not…

more

necessarily related to SVG or XSS.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1108 Redundant Access Stealth
**This technique has been deprecated.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1505 Server Software Component Persistence
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
T1554 Compromise Host Software Binary Persistence
Adversaries may modify host software binaries to establish persistent access to systems.
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-2749Same product: Kentico Xperience
CVE-2025-2748Same product: Kentico Xperience
CVE-2023-53934Same product: Kentico Xperience
CVE-2017-17736Same product: Kentico Xperience
CVE-2019-10068Same product: Kentico Xperience
CVE-2025-2746Same product: Kentico Xperience
CVE-2025-2747Same product: Kentico Xperience
CVE-2025-32369Same product: Kentico Xperience
CVE-2023-53737Same product: Kentico Xperience
CVE-2024-58321Same product: Kentico Xperience

Affected Assets

kentico
xperience
≤ 13.0.178

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V5.1.1

Mitigating Controls (NIST 800-53 r5) AI

Maintaining and reviewing a documented baseline configuration allows comparison that reveals any functionality absent from the approved specification.

Least-functionality configuration explicitly prohibits or restricts any capability not required by the approved baseline, blocking hidden additions.

Developer testing and evaluation activities are designed to discover undocumented or unspecified functionality after it has been introduced.

Malicious-code protection at entry points blocks dangerous file types from being accepted and executed.

Documented development processes and standards require all functionality to be specified and visible, structurally preventing undocumented hidden features.

An SDLC that incorporates security engineering principles mandates that all product functions be part of the approved specification.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match
prevents

Secure SDLC practices directly prevent introduction of undocumented hidden functionality during development.

ID.RA-09 mostly match
prevents

Pre-acquisition integrity/authenticity checks can detect undocumented hidden functions in supplied software/hardware.

PR.PS-05 mostly match
prevents

Restricting execution of unauthorized software directly blocks dangerous uploaded files from running.

PR.PS-01 partial match
prevents

Hardened configuration baselines can enforce allowed file types and processing rules.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing in development and acceptance can discover undocumented functionality before release.

prevents

Change management processes can catch unauthorized additions but do not inherently prevent hidden functionality from being introduced.

finds

Monitoring activities can detect anomalous behavior from hidden functions but do not eliminate the weakness.

prevents

Secure development life cycle mandates documented requirements and design reviews that would expose undocumented hidden functionality.

prevents

Application security requirements explicitly define expected functionality, making hidden features a violation.

prevents

Secure system architecture and engineering principles require transparent, documented designs that preclude hidden functionality.

References