GitHub Advisoryadvisory · Packagist
GHSA-2295-vh28-pphc Cross-site Scripting (XSS) in DataObjects QuantityValue Unit Definition
MEDIUM
Official page ↗
- Aliases
- CVE-2023-2328
- Ecosystem
- Packagist
- Packages
- pimcore/pimcore
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
- Weaknesses
- CWE-79
- Reviewed
- 2023-04-27
Affected packages
• Packagist pimcore/pimcore: < 10.5.21 → fixed in 10.5.21
Description
Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.
Patches
Update to version 10.5.21 or apply these patches manually https://github.com/pimcore/pimcore/commit/e3562bfe249c557d15474c9a0acd5e06628521fe.patch
https://github.com/pimcore/pimcore/commit/b9c9ca2371aa643dbc4caca162ff3400266ff96f.patch
Workarounds
Apply patches:
https://github.com/pimcore/pimcore/commit/e3562bfe249c557d15474c9a0acd5e06628521fe.patch
https://github.com/pimcore/pimcore/commit/b9c9ca2371aa643dbc4caca162ff3400266ff96f.patch
References
https://huntr.dev/bounties/01a44584-e36b-46f4-ad94-53af488397f6/
Related
Alias · CVE (1)
- CVE-2023-2328 Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/pimcore/pimcore/security/advisories/GHSA-2295-vh28-pphc web
- https://nvd.nist.gov/vuln/detail/CVE-2023-2328 advisory
- https://github.com/pimcore/pimcore/commit/e3562bfe249c557d15474c9a0acd5e06628521fe web
- https://github.com/pimcore/pimcore package
- https://huntr.dev/bounties/01a44584-e36b-46f4-ad94-53af488397f6 web