CVE-2022-50685

Kentico Xperience <= 13.0.56 File Upload Stored XSS

CVSS 5.1 MEDIUMEPSS 0.1%CWE-79

A stored cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via XML file uploads as page attachments or metafiles. Attackers can upload malicious XML files that enable stored XSS, allowing malicious scripts to execute in users' browsers.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Produtos afetados

Kentico · Xperience

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://devnet.kentico.com/download/hotfixes https://www.vulncheck.com/advisories/kentico-xperience-file-upload-stored-xss2