PT-2021-23997 · Kentico · Kentico Xperience Cms

Published 2021-12-03 · Updated 2021-12-06 · CVE-2021-43991

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Kentico Xperience CMS versions 13.0 through 13.0.43

Description: The issue is related to a persistent Cross-Site Scripting (XSS) vulnerability, also known as Stored or Second-Order XSS. This occurs when the application stores and retrieves client-supplied data without proper handling of dangerous content. An attacker could exploit this by submitting malicious script content to the application, which is then retrieved and executed by other application users. This could lead to attacks such as session hijacking, account takeover, and accessing sensitive data.

Recommendations: For Kentico Xperience CMS versions 13.0 through 13.0.43, update to a version outside of the affected range to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-43991

Affected Products

Kentico Xperience Cms

References · 4

• 🔥 https://appcheck-ng.com/persistent-xss-kentico-cms · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-43991 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43991 · Vendor Advisory
• https://t.me/cibsecurity/33316 · Telegram Post