CVE-2024-58320 MEDIUM

CVE-2024-58320: Kentico Xperience <= 13.0.159 Authentication Information Disclosure

Vendor Kentico

Product Xperience

Weakness CWE-497

Published December 18, 2025

Last update December 18, 2025

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

An information disclosure vulnerability in Kentico Xperience allows public users to access sensitive administration interface hostname details during authentication. Attackers can retrieve confidential hostname configuration information through a public endpoint, potentially exposing internal network details.

Key dates

02Disclosure timeline

December 18, 2025 CVE published

December 18, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-58320 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/497.html

Related vulnerabilities

04Related CVE

CVE-2025-14712 JHENG GAO｜Student Learning Assessment and Support System - Exposure of Sensitive Information CVE-2025-68551 WordPress VPSUForm plugin <= 3.2.24 - Sensitive Data Exposure vulnerability CVE-2026-24553 WordPress Fraud Prevention For Woocommerce plugin <= 2.3.2 - Sensitive Data Exposure vulnerability CVE-2025-2988 IBM Sterling B2B Integrator and IBM Sterling File Gateway information disclosure CVE-2025-31003 WordPress Squeeze plugin <= 1.6 - Full Path Disclosure (FPD) vulnerability