CVE-2018-7205

Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious…

published February 20, 2018

CVSS
—
EPSS
1%
Percentile
56.9
In the wild
Unconfirmed
What it is

Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScript via a malicious devicename parameter in a link that is entered via the "Pages -> Edit template properties -> Device Layouts -> Create device layout (and edit created device layout) -> Design" screens. NOTE: the vendor has responded that there is intended functionality for authorized users to edit and update ascx code layout

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00830 · 56.9th percentile
Published
2018-02-20T15:00Z
EPSS history
Timeline
  • 20 FEB 15:00Z
    Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious…
    cvelistv5