Description (CNA)
A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-Type that do not match file extensions. Attackers can exploit this vulnerability by uploading malicious files with manipulated MIME types, allowing malicious scripts to execute in users' browsers.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Kentico / Xperience | affected 0 through 12.0.49 |
CWE
CWE-79
References
- https://devnet.kentico.com/download/hotfixes
- https://www.vulncheck.com/advisories/kentico-xperience-file-upload-stored-xss
ADP enrichment
No English description supplied.
No references supplied.