CVE-2018-7205 - CVE House
Back to Database
Status published Medium CVE-2018-7205

Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout"...

Vulnerability Description

Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScript via a malicious devicename parameter in a link that is entered via the "Pages -> Edit template properties -> Device Layouts -> Create device layout (and edit created device layout) -> Design" screens. NOTE: the vendor has responded that there is intended functionality for authorized users to edit and update ascx code layout

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-7205

Credits & Attribution

No credits recorded in the NVD database.

References

More from kentico

View All →
CVE-2022-32387
In Kentico before 13.0.66, attackers can achieve Denial of Service...
High 7.5
CVE-2022-29287
Kentico CMS before 13.0.66 has an Insecure Direct Object Reference...
Medium 4.9
CVE-2021-46163
Kentico Xperience 13.0.44 allows XSS via an XML document to...
Medium 6.1
CVE-2021-27581
The Blog module in Kentico CMS 5.5 R2 build 5.5.3996...
Critical 9.8
CVE-2020-24794
Cross Site Scripting (XSS) vulnerability in Kentico before 12.0.75....
Medium 6.1

Affected Vendor

Affected Software

xperience
Vulnerable Versions:
9.0

Timeline

Official Publish: February 20th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.