Take the community feedback survey now.

Magnus Rahl
Aug 16, 2023
  3763
(3 votes)

XSS vulnerability in CMS 11 and 12

Introduction

A potential security vulnerability was detected for Optimizely CMS that could affect CMS 11 installations before v11.37.1 and CMS 12 installations before v12.16.0.  

  • In a CMS 11 installation where request validation has been disabled, the vulnerability allows execution of JavaScript included in a manipulated URL. This allows the possibility to run arbitrary JavaScript code in the context of the logged in user.
  • In a CMS 12 installation, the vulnerability allows execution of JavaScript included in a manipulated URL.

Example attack

In CMS 11, when the request validation has been either completely or partially disabled by configuring requestValidationMode in the applications web.config file, harmful requests are allowed to reach the application.

An attacker provides a manipulated URL that includes harmful JavaScript code that a user can interact with. After successful authentication and authorization, the supplied JavaScript is executed in the context of the browser, the web application, and the permissions of the user. The attack is only possible for authenticated users and in installations where request validation is completely or partially disabled.

Risk

Overall, the risk of the vulnerability is low-medium. The attack is possible for only authenticated users and requires user interaction to execute. The issue was fixed in CMS v11.37.1 (CMS-28190) and CMS v12.16.0 (CMS-26236). Mitigation is in place for all DXP service customers.

Remediation

  • If using CMS 11, please update Optimizely CMS to the latest version.
  • If using CMS 12, please update to the latest version.
  • As a general best practice, it is recommended to restrict the number of users with admin privileges.

Questions

Please contact the security engineering team at securityeng@optimizely.com.

Risk definitions

Low – little to no potential impact on Optimizely or customer environments/data. Vulnerability has low exploitability, for example: requirement for local or physical system access, zero reachability to/executability within Optimizely products/code.

Medium – some potential impact on Optimizely or customer environments/data. Vulnerability has medium exploitability, for example: requirement to be located on the same local network as the target, requirement for an individual to be manipulated via social engineering, requirement for user privileges, vulnerability achieves limited access to Optimizely products/code.

High – high potential impact on Optimizely or customer environments/data.  Vulnerability has high exploitability, for example:  achieves high level access to Optimizely products/code, could elevate privileges, could result in a significant data loss or downtime.

Critical – very significant potential impact on Optimizely or customer environments/data.  Vulnerability has very high exploitability, for example: achieves admin/root-level access to Optimizely products/code.  Vulnerability does not require any special authentication credentials/knowledge of Optimizely products/environments. 

Aug 16, 2023

Comments

Please login to comment.
Latest blogs
Image Generation with Gemini 2.5 Flash

Gemini 2.5 Flash Image, nicknamed Nano Banana, is Google DeepMind’s newest image generation & editing model. It blends text‑to‑image, multi‑image...

Luc Gosso (MVP) | Oct 8, 2025 |

Automated Page Audit for Large Content Sites in Optimizely

Large content sites often face significant challenges in maintaining visibility and control over thousands of pages. Content managers struggle to...

Sanjay Kumar | Oct 6, 2025

Optimizely CMS Roadmap – AI, automation and the future of digital experiences

A summary of the roadmap for Optimizely CMS from the Opticon conference on September 30, 2025.

Tomas Hensrud Gulla | Oct 6, 2025 |

Get last edited content from Optimizely CMS

Learn how to query the last updated blocks and pages from Optimizely CMS

Tomas Hensrud Gulla | Oct 4, 2025 |

Optimizely CMS - Learning by Doing: EP04 – Create Content Models

  Introduction I am thrilled to announce the release of Episode 4 of my  Learning by Doing : Build Series on Optimizley CMS 12 on YouTube ! This...

Ratish | Oct 2, 2025 |

A day in the life of an Optimizely OMVP - Opticon London 2025

This installment of a day in the life of an Optimizely OMVP gives an in-depth coverage of my trip down to London to attend Opticon London 2025 held...

Graham Carr | Oct 2, 2025