Executive Summary

CVE-2022-50683 is a stored cross-site scripting (XSS) vulnerability in Kentico Xperience up to version 13.0.74. It occurs because the application does not properly neutralize input in the form redirect URL configuration. Attackers can inject malicious scripts into this configuration, which are then stored and executed in the browsers of users who access the affected form settings. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in users' browsers via the form redirect URL configuration. This can lead to unauthorized actions performed on behalf of users, theft of sensitive information, or other malicious activities that compromise user security and trust. The impact is considered medium severity with low confidentiality, integrity, and availability impacts. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your Kentico Xperience installation is version 13.0.74 or earlier and if the form redirect URL configuration allows injection of malicious scripts. Specific detection commands are not provided in the available resources. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include applying the hotfixes provided by Kentico as referenced in the Kentico DevNet, and reviewing and sanitizing form redirect URL configurations to prevent injection of malicious scripts. [1]

Useful 0 Not Useful 0