CVE-2020-24794: 
Kentico Xperience vulnerability analysis and mitigation

Cross Site Scripting (XSS) vulnerability was discovered in Kentico before version 12.0.75. The vulnerability was disclosed on September 9, 2020, affecting Kentico CMS installations. The vulnerability requires user interaction to be exploited and can be accessed through network vectors without requiring privileges (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. Under CVSS v2.0, it received a Base Score of 4.3 (MEDIUM) with the vector (AV:N/AC:M/Au:N/C:N/I:P/A:N). The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

The vulnerability allows attackers to execute cross-site scripting attacks that could potentially lead to unauthorized access to user data and compromise of user sessions. The CVSS scores indicate that the vulnerability has low impact on both confidentiality and integrity, with no impact on availability (NVD).

The vulnerability requires user interaction to be exploited and can be accessed through network vectors without requiring privileges. The attack complexity is considered low according to the CVSS v3.1 scoring (NVD).

The vulnerability has been fixed in Kentico version 12.0.75. Users are recommended to upgrade to this version or later to mitigate the risk. The fix is available through the vendor's hotfix distribution system (Kentico DevNet).