CVE-2019-13493: XSS
In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Sitecore vulnerability?
The vulnerability ID for this Sitecore vulnerability is CVE-2019-13493.
What is the severity level of CVE-2019-13493?
The severity level of CVE-2019-13493 is medium with a CVSS score of 5.4.
What is the description of CVE-2019-13493?
CVE-2019-13493 is a Persistent XSS vulnerability in Sitecore 9.0 rev 171002, specifically in the Media Library and File Manager. An authenticated unprivileged user can inject arbitrary JavaScript by modifying the uploaded file extension parameter.
Which software version is affected by CVE-2019-13493?
CVE-2019-13493 affects Sitecore Experience Platform version 9.0.
Is there a solution or fix available?
Yes, it is recommended to apply the necessary patches or updates provided by Sitecore to fix CVE-2019-13493.