Skip to content

Cross-site Scripting (XSS) in name field of Custom Reports

Moderate
dvesh3 published GHSA-m6m9-gr85-79vm May 10, 2023

Package

composer pimcore/pimcore (Composer)

Affected versions

< 10.5.21

Patched versions

10.5.21

Description

Impact

This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

Patches

Update to version 10.5.21 or apply this patches manually
https://github.com/pimcore/pimcore/commit/c36ef54ce33f7b5e74b7b0ab9eabfed47c018fc7.patch

Workarounds

Apply patches manually:
https://github.com/pimcore/pimcore/commit/c36ef54ce33f7b5e74b7b0ab9eabfed47c018fc7.patch

References

https://huntr.dev/bounties/1a5e6c65-2c5e-4617-9411-5b47a7e743a6/

Severity

Moderate

CVE ID

CVE-2023-2614

Weaknesses

Credits