Description (CNA)
An information disclosure vulnerability in Kentico Xperience allows attackers to leak virtual context URLs via the HTTP Referer header when users interact with third-party domains. Sensitive virtual context information can be exposed to external domains through page builder interactions and link/image loading.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Kentico / Xperience | affected 0 through 12.0.47 |
CWE
CWE-497
References
- https://devnet.kentico.com/download/hotfixes
- https://www.vulncheck.com/advisories/kentico-xperience-virtual-context-information-disclosure
ADP enrichment
No English description supplied.
No references supplied.