CVE-2023-53934
Kentico Xperience ≤ 12.0.98
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-53934 is a high-severity Improper Neutralization of Server-Side Includes (SSI) Within a Web Page (CWE-97) vulnerability in Kentico Xperience. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked at the 35th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-204344
Vulnerability Data
A denial of service vulnerability in Kentico Xperience allows attackers to launch DoS attacks via specially crafted requests to the GetResource handler. Improper input validation enables remote attackers to potentially disrupt service availability through maliciously constructed requests.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly stops untrusted data from being interpreted as SSI directives during page generation.
Engineering principles require proper input neutralization to avoid injection of server-side directives.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization to block SSI injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.25 mandates secure SDLC practices including secure coding guidelines, security requirements, checkpoints, testing (scans/penetration), and developer training that reach SSI neutralization; this prevents exploitation for a minority slice of instances (those caught in development) while most production SSI flaws remain exploitable until found and fixed later.
Application security requirements include rules for neutralizing server-side directives in user input.
A.8.27 mandates security-by-design principles (including distrust external input, data validation/sanitization, secure architecture layers and design reviews against attack patterns) that reach SSI injection when applied to web output generation, but the clause is a process of establishing/applying/reviewing principles rather than a concrete mechanism that guarantees neutralization of every SSI directive, leaving a bounded remainder where principles exist but are incompletely followed in code.
Secure coding standards explicitly require escaping or disabling SSI constructs in dynamic web content.
Security testing can detect SSI flaws but does not itself implement the neutralization controls.