GitHub Advisoryadvisory · Packagist
GHSA-q7cc-m6jw-m262 Pimcore Cross-site Scripting (XSS) in Predefined Properties delete
MEDIUM
Official page ↗
- Aliases
- CVE-2023-2615
- Ecosystem
- Packagist
- Packages
- pimcore/pimcore
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2023-05-10
Affected packages
• Packagist pimcore/pimcore: < 10.5.21 → fixed in 10.5.21
Description
Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.
Patches
Update to version 10.5.21 or apply this patches manually
https://github.com/pimcore/pimcore/commit/7a799399e6843cd049e85da27ceb75b78505317f.patch
Workarounds
Apply patches manually:
https://github.com/pimcore/pimcore/commit/7a799399e6843cd049e85da27ceb75b78505317f.patch
References
https://huntr.dev/bounties/af9c360a-87f8-4e97-a24b-6db675ee942a/
Related
Alias · CVE (1)
- CVE-2023-2615 Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/pimcore/pimcore/security/advisories/GHSA-q7cc-m6jw-m262 web
- https://nvd.nist.gov/vuln/detail/CVE-2023-2615 advisory
- https://github.com/pimcore/pimcore/commit/7a799399e6843cd049e85da27ceb75b78505317f web
- https://github.com/pimcore/pimcore package
- https://huntr.dev/bounties/af9c360a-87f8-4e97-a24b-6db675ee942a web