GitHub Advisoryadvisory · Packagist
GHSA-2c67-p4xh-m34w Cross-site Scripting (XSS) in Website Settings name field
MEDIUM
Official page ↗
- Aliases
- CVE-2023-2342
- Ecosystem
- Packagist
- Packages
- pimcore/pimcore
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2023-04-27
Affected packages
• Packagist pimcore/pimcore: < 10.5.21 → fixed in 10.5.21
Description
Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.
Patches
Update to version 10.5.21 or apply this patches manually
https://github.com/pimcore/pimcore/commit/07a2c95be524c7e20105cef58c5767d4ebb06091.patch
https://github.com/pimcore/pimcore/commit/42a5bbe5f16b97371fdbfdcf2bb3ee759dea8564.patch
Workarounds
Apply patches manually:
https://github.com/pimcore/pimcore/commit/07a2c95be524c7e20105cef58c5767d4ebb06091.patch
https://github.com/pimcore/pimcore/commit/42a5bbe5f16b97371fdbfdcf2bb3ee759dea8564.patch
References
https://huntr.dev/bounties/01cd3ed5-dce8-4021-9de0-81cb14bf1829/
Related
Alias · CVE (1)
- CVE-2023-2342 Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/pimcore/pimcore/security/advisories/GHSA-2c67-p4xh-m34w web
- https://nvd.nist.gov/vuln/detail/CVE-2023-2342 advisory
- https://github.com/pimcore/pimcore/commit/42a5bbe5f16b97371fdbfdcf2bb3ee759dea8564 web
- https://github.com/pimcore/pimcore package
- https://huntr.dev/bounties/01cd3ed5-dce8-4021-9de0-81cb14bf1829 web