CVE-2018-7205: XSS
DISPUTED Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScript via a malicious devicename parameter in a link that is entered via the "Pages -> Edit template properties -> Device Layouts -> Create device layout (and edit created device layout) -> Design" screens. NOTE: the vendor has responded that there is intended functionality for authorized users to edit and update ascx code layout.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7205?
CVE-2018-7205 is an unverified vulnerability that is categorized as medium severity due to its potential for enabling reflected cross-site scripting.
What types of software are affected by CVE-2018-7205?
CVE-2018-7205 affects Kentico CMS versions 9 through 11.
How can I fix CVE-2018-7205?
To mitigate CVE-2018-7205, update Kentico CMS to a version beyond 11 or sanitize the devicename parameter to prevent script execution.
Who can exploit CVE-2018-7205?
Remote attackers with the ability to craft malicious links can exploit CVE-2018-7205.
What is the impact of CVE-2018-7205 on web applications?
CVE-2018-7205 could allow attackers to inject and execute malicious JavaScript in the context of a user’s browser, potentially compromising sensitive user data.