Vulnerability Details : CVE-2021-43991
The Kentico Xperience CMS version 13.0 – 13.0.43 is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS). Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data without proper handling of dangerous content. This type of XSS vulnerability is exploited by submitting malicious script content to the application which is then retrieved and executed by other application users. The attacker could exploit this to conduct a range of attacks against users of the affected application such as session hijacking, account take over and accessing sensitive data.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2021-43991
- cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-43991
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 23 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-43991
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
3.5
|
LOW | AV:N/AC:M/Au:S/C:N/I:P/A:N |
6.8
|
2.9
|
NIST | |
|
6.8
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N |
2.3
|
4.0
|
AppCheck Ltd. | |
|
5.4
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
2.3
|
2.7
|
NIST |
CWE ids for CVE-2021-43991
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by:
- info@appcheck-ng.com (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2021-43991
-
https://appcheck-ng.com/persistent-xss-kentico-cms/
Security Advisory: Persistent XSS via Avatar Upload in Kentico CMS (CVE-2021-43991) | AppCheckExploit;Third Party Advisory
Jump to