CVE-2019-25228: fallo de gravedad media en Kentico Xperience
Kentico Xperience <= 12.0.47 Virtual Context Information Disclosure
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.1epss 0.3%
An information disclosure vulnerability in Kentico Xperience allows attackers to leak virtual context URLs via the HTTP Referer header when users interact with third-party domains. Sensitive virtual context information can be exposed to external domains through page builder interactions and link/image loading.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
Kentico · XperienceCVEs relacionadas — Kentico Xperience
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-2747CRITICALKentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication BypassEPSS 97.2%KEVCVE-2025-2746CRITICALKentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication BypassEPSS 74.1%KEVCVE-2025-2749HIGHKentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCEEPSS 4.0%KEVCVE-2025-2748MEDIUMKentico Xperience stored cross-site scripting in multiple-file upload functionalityEPSS 60.6%CVE-2025-32370HIGHCVE-2025-32370EPSS 1.6%CVE-2025-2794HIGHKentico Xperience <= 13.0.180 Unsafe ReflectionEPSS 0.5%