CVE-2024-58318
BaseFortify
Publication date: 2025-12-18
Last updated on: 2025-12-27
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kentico | xperience | to 13.0.162 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2024-58318 is a stored cross-site scripting (XSS) vulnerability in Kentico Xperience's rich text editor component used for page and form builders. Attackers can inject malicious scripts via this editor, often through malicious URIs, which then execute in the browsers of users who view the affected content. This happens due to improper neutralization of input during web page generation. [1]
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute malicious scripts in the browsers of users viewing the affected content. This can lead to unauthorized actions performed on behalf of users, theft of sensitive information, session hijacking, or other malicious activities that compromise user security and trust. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by inspecting the content entered through the rich text editor component in Kentico Xperience, looking for injected malicious scripts or suspicious URIs. Since it is a stored XSS, monitoring HTTP requests and responses for unexpected script tags or encoded payloads in pages or forms built with the rich text editor can help identify exploitation attempts. Specific commands are not provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the hotfixes provided by the Kentico Security Team to address the vulnerability in the rich text editor component. Additionally, restricting user input in the rich text editor, sanitizing inputs, and monitoring for suspicious activity can help reduce risk until patches are applied. [1]