« Volver al listado

CVE-2026-102100

Estado: En análisisAlta (8.7)—

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated session. This could be used to perform actions on the victim's behalf and may have permitted account takeover, including of higher-privileged users. Exploitation requires the victim to view the attacker-supplied content.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

XSS almacenado (CWE-79) en aplicación web que requiere visualización de contenido malicioso. Permite ejecución de JavaScript en navegador de usuario autenticado, potenciando secuestro de cuenta con escalada a usuarios privilegiados.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict Web-Based ContentDisable or Remove Feature or ProgramUser TrainingPrivileged Account ManagementMulti-factor AuthenticationExecution Prevention

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Kiteworks — Kiteworks CoreAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-102100",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "9119a7d8-5eab-497f-8521-727c672e3725",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "affectedData": [
        {
          "vendor": "Kiteworks",
          "product": "Core",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "9.5.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "9.5.0"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2026-09-30T21:16:56.750",
  "references": [
    {
      "url": "https://github.com/kiteworks/security-advisories/security/advisories/GHSA-vr65-9jwc-jgjx",
      "source": "9119a7d8-5eab-497f-8521-727c672e3725"
    },
    {
      "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json",
      "source": "9119a7d8-5eab-497f-8521-727c672e3725"
    }
  ],
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated session. This could be used to perform actions on the victim's behalf and may have permitted account takeover, including of higher-privileged users. Exploitation requires the victim to view the attacker-supplied content."
    }
  ],
  "lastModified": "2026-10-01T02:17:43.350",
  "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725"
}