CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2024-12907: XSS in Kentico 7
5.3
CVSS
Description
Kentico CMS in version 7 is vulnerable to a Reflected XSS attacks through manipulation of a specific GET request parameter sent to /CMSMessages/AccessDenied.aspx endpoint.
Notably, support for this version of Kentico ended in 2016. Version 8 was tested as well and does not contain this vulnerability.
Classification
CVE ID: CVE-2024-12907
CVSS Base Severity: MEDIUM
CVSS Base Score: 5.3
Affected Products
Vendor: Kentico
Product: Kentico CMS
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 11.48% (scored less or equal to compared to others)
EPSS Date: 2025-02-04 (when was this score calculated)