CVE-2022-50683
BaseFortify
Publication date: 2025-12-18
Last updated on: 2025-12-27
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kentico | xperience | to 13.0.74 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2022-50683 is a stored cross-site scripting (XSS) vulnerability in Kentico Xperience up to version 13.0.74. It occurs because the application does not properly neutralize input in the form redirect URL configuration. Attackers can inject malicious scripts into this configuration, which are then stored and executed in the browsers of users who access the affected form settings. [1]
How can this vulnerability impact me? :
This vulnerability allows attackers to execute malicious scripts in users' browsers via the form redirect URL configuration. This can lead to unauthorized actions performed on behalf of users, theft of sensitive information, or other malicious activities that compromise user security and trust. The impact is considered medium severity with low confidentiality, integrity, and availability impacts. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if your Kentico Xperience installation is version 13.0.74 or earlier and if the form redirect URL configuration allows injection of malicious scripts. Specific detection commands are not provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the hotfixes provided by Kentico as referenced in the Kentico DevNet, and reviewing and sanitizing form redirect URL configurations to prevent injection of malicious scripts. [1]