CVE-2021-43991 Persistent XSS via Avatar Upload in Kentico Xperience CMS

Medium 6.8 Published 3 Dec 2021 Updated 4 Aug 2024

Attackers can inject persistent scripts via avatar uploads, leading to session hijacking and account takeover for other users.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2021-43991?

CVE-2021-43991 is a medium-severity cross-site scripting vulnerability in Kentico Xperience, published on 3 Dec 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

The Kentico Xperience CMS version 13.0 – 13.0.43 is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS). Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data without proper handling of dangerous content. This type of XSS vulnerability is exploited by submitting malicious script content to the application which is then retrieved and executed by other application users. The attacker could exploit this to conduct a range of attacks against users of the affected application such as session hijacking, account take over and accessing sensitive data.

Weakness: CWE-79

Which versions are affected by CVE-2021-43991?

It affects 1 product.

Products include Kentico Xperience.

How do I fix CVE-2021-43991?

No fix has been published for CVE-2021-43991 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-43991 being exploited?

There is no known exploitation of CVE-2021-43991 in the wild and no public exploit code.

All Kentico Xperience vulnerabilities

Sources

Also known as GHSA-r763-2x4q-j7xx.