Stored Cross-Site Scripting in Kentico Xperience

CVE-2020-36891

What is CVE-2020-36891?

A stored cross-site scripting vulnerability exists in Kentico Xperience, enabling attackers to upload files with spoofed Content-Type headers that do not align with the actual file extensions. This exploit allows the execution of malicious scripts in the browsers of users who interact with the compromised files, posing a significant risk to the security and integrity of web applications utilizing the affected version of Kentico Xperience.

References