Executive Summary

CVE-2022-50685 is a stored cross-site scripting (XSS) vulnerability in Kentico Xperience up to version 13.0.56. Authenticated users can upload malicious XML files as page attachments or metafiles. These files contain scripts that are improperly neutralized and get stored on the server. When other users view the affected pages, the malicious scripts execute in their browsers, potentially compromising their security. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute malicious scripts in the browsers of users who view the affected pages. This can lead to theft of user data, session hijacking, or other malicious actions performed on behalf of the user. Since the attack requires authenticated users to upload malicious XML files, it can be exploited by insiders or compromised accounts. The overall impact is medium severity with low confidentiality and integrity impacts but can still pose a security risk to users. [1]

Useful 0 Not Useful 0

Detection Guidance

Detection involves identifying if malicious XML files have been uploaded as page attachments or metafiles by authenticated users in Kentico Xperience versions up to 13.0.56. Since the vulnerability is exploited via stored XSS through XML uploads, monitoring upload logs for suspicious XML files or scanning the web application for stored XSS payloads in page attachments can help detect exploitation. Specific commands are not provided in the available resources. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include applying the available hotfixes provided by Kentico DevNet to patch the vulnerability. Additionally, restricting or monitoring authenticated user uploads of XML files as page attachments or metafiles can reduce risk until patches are applied. [1]

Useful 0 Not Useful 0