Medium severity · published Jul 17, 2019
CVE-2019-13493
In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager
5.4
CVSS
1.6%
EPSS
No
On KEV
Description
In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EP
Experience Platform · Sitecore
9.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-13493
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-13493
Exploit
http://packetstormsecurity.com/files/153613/Sitecore-9.0-Rev-171002-Cross-Site-Scripting.html
More from Experience Platform
9.8
CVE-2021-42237
Sitecore XP Remote Command Execution Vulnerability
9.8
CVE-2019-9874
Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
9.0
CVE-2025-53690
Sitecore Products ViewState Deserialization Vulnerability
9.8
CVE-2025-53693
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP)…
9.8
CVE-2023-35813
Multiple Sitecore products allow remote code execution