Kentico Xperience Information Disclosure Vulnerability via HTTP Referer Header

A vulnerability allowing information disclosure has been identified in Kentico Xperience versions through 12.0.47. This vulnerability allows attackers to leak sensitive virtual context URLs via the HTTP Referer header when users interact with third-party domains. The exposed information can be accessed by external domains through page builder interactions and the loading of links or images.

Impact

Exploitation of this vulnerability could lead to unauthorized exposure of sensitive virtual context information to external domains.

Remediation

Users can upgrade to Kentico Xperience version 13.0.198 or later, where this vulnerability has been addressed. Instructions for applying the hotfix are available on the Kentico Xperience DevNet.