GitHub Advisoryadvisory · Packagist

GHSA-rcg9-hrhx-6q69 Pimcore has Cross-site Scripting vulnerability in DataObject tooltip field

MEDIUM Published 2023-03-20 Modified 2023-03-20 Official page ↗
Aliases
CVE-2023-28429
Ecosystem
Packagist
Packages
pimcore/pimcore
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-03-20

Affected packages

• Packagist pimcore/pimcore: < 10.5.19 → fixed in 10.5.19

Description

Impact Unsecured tooltip field in DataObject class definition. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Patches Update to version 10.5.19 or apply this patch manually https://github.com/pimcore/pimcore/pull/14574.patch Workarounds Apply https://github.com/pimcore/pimcore/pull/14574.patch manually. References

Related

Alias · CVE (1)

  • CVE-2023-28429 Pimcore is an open source data and experience management platform. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References