GitHub Advisoryadvisory · Packagist
GHSA-r7mm-jx6h-hv7m Cross-site Scripting (XSS) in Conditions tab of Pricing Rules
MEDIUM
Official page ↗
- Aliases
- CVE-2023-2332
- Ecosystem
- Packagist
- Packages
- pimcore/pimcore
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
- Weaknesses
- CWE-79
- Reviewed
- 2023-04-27
Affected packages
• Packagist pimcore/pimcore: < 10.5.21 → fixed in 10.5.21
Description
Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.
Patches
Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/a4491551967d879141a3fdf0986a9dd3d891abfe.patch
Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/a4491551967d879141a3fdf0986a9dd3d891abfe.patch manually.
References
https://huntr.dev/bounties/e436ed71-6741-4b30-89db-f7f3de4aca2c/
Related
Alias · CVE (1)
- CVE-2023-2332 A stored Cross-site Scripting (XSS) vulnerability exists in the Conditions tab of Pricing Rules in pimcore/pimcore versions 10.5.19. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/pimcore/pimcore/security/advisories/GHSA-r7mm-jx6h-hv7m web
- https://nvd.nist.gov/vuln/detail/CVE-2023-2332 advisory
- https://github.com/pimcore/pimcore/commit/a4491551967d879141a3fdf0986a9dd3d891abfe web
- https://github.com/pimcore/pimcore package
- https://huntr.com/bounties/e436ed71-6741-4b30-89db-f7f3de4aca2c web