medium5.4Public exploit code
CVE-2019-13493
In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Sitecore 9.0 rev 171002 - Persistent Cross-Site Scripting2019-07-11 · webapps · aspx
Impact
In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sitecore | Experience Platform | Version 9.0 |