GitHub Advisoryadvisory · Packagist
GHSA-6qjm-39vh-729w Pimcore Cross-site Scripting in Predefined Asset Metadata module in Settings
MEDIUM
Official page ↗
- Aliases
- CVE-2023-1702
- Ecosystem
- Packagist
- Packages
- pimcore/pimcore
- Severity
- Moderate
- Weaknesses
- CWE-79
- Reviewed
- 2023-03-31
Affected packages
• Packagist pimcore/pimcore: < 10.5.20 → fixed in 10.5.20
Description
Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.
Patches
Update to version 10.5.20 or apply this patch manually https://github.com/pimcore/pimcore/pull/14721.patch
Workarounds
Apply patch manually https://github.com/pimcore/pimcore/pull/14721.patch
References
https://huntr.dev/bounties/d8a47f29-3297-4fce-b534-e1d95a2b3e19
Related
Alias · CVE (1)
- CVE-2023-1702 Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/pimcore/pimcore/security/advisories/GHSA-6qjm-39vh-729w web
- https://nvd.nist.gov/vuln/detail/CVE-2023-1702 advisory
- https://github.com/pimcore/pimcore/pull/14721.patch web
- https://github.com/pimcore/pimcore/commit/2b997737dd6a60be2239a51dd6d9ef5881568e6d web
- https://github.com/pimcore/pimcore package
- https://huntr.dev/bounties/d8a47f29-3297-4fce-b534-e1d95a2b3e19 web