CRLF Injection Vulnerability in Kentico Xperience by Kentico
CVE-2022-50682

6.9MEDIUM

Key Information:

Vendor

Kentico

Status
Xperience
Vendor
CVE Published:
18 December 2025

What is CVE-2022-50682?

A CRLF injection vulnerability in Kentico Xperience permits attackers to manipulate query string redirects. This misconfiguration in the routing engine allows for improper encoding, which can lead to header injection. Exploiting this vulnerability may pave the way for further attacks on the web application, jeopardizing its integrity and confidentiality.

Affected Version(s)

Xperience 0 <= 13.0.79

References

https://devnet.kentico.com/download/hotfixes
vendor-advisorypatch
https://www.vulncheck.com/advisories/kentico-xperience-ro...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tom Waldman
JSON
.
CVE-2022-50682 : CRLF Injection Vulnerability in Kentico Xperience by Kentico