1. Home
  2. CVE Database
  3. CVE-2019-25228
MEDIUM · 5.3

CVE-2019-25228

An information disclosure vulnerability in Kentico Xperience allows attackers to leak virtual context URLs via the HTTP Referer header when users interact with third-party domains. Sensitive virtual c...

Vulnerability Description

An information disclosure vulnerability in Kentico Xperience allows attackers to leak virtual context URLs via the HTTP Referer header when users interact with third-party domains. Sensitive virtual context information can be exposed to external domains through page builder interactions and link/image loading.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
KenticoXperience<= 12.0.47

Related Weaknesses (CWE)

CWE-497

References

FAQ

What is CVE-2019-25228?

CVE-2019-25228 is a vulnerability with a CVSS score of 5.3 (MEDIUM). An information disclosure vulnerability in Kentico Xperience allows attackers to leak virtual context URLs via the HTTP Referer header when users interact with third-party domains. Sensitive virtual c...

How severe is CVE-2019-25228?

CVE-2019-25228 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-25228?

Check the references section above for vendor advisories and patch information. Affected products include: Kentico Xperience.