PT-2023-18905 · Pimcore · Pimcore

Aryaantony92 · Publicado 2023-04-27 · Atualizado 2024-11-19 · CVE-2023-2332

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Média

Vetor base

AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions pimcore/pimcore version 10.5.19

Description A stored Cross-site Scripting (XSS) vulnerability exists in the Conditions tab of Pricing Rules, specifically in the From and To fields of the Date Range section. This allows an attacker to inject malicious scripts, potentially leading to the execution of arbitrary JavaScript code in the context of the user's browser. The issue can result in stealing cookies or redirecting users to malicious sites.

Recommendations Update to version 10.5.21 to resolve the issue. As a temporary workaround, consider applying the patch manually from https://github.com/pimcore/pimcore/commit/a4491551967d879141a3fdf0986a9dd3d891abfe.patch to mitigate the risk.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-2332

GHSA-R7MM-JX6H-HV7M

Produtos afetados

Pimcore

Referências · 10

• 🔥 https://huntr.com/bounties/e436ed71-6741-4b30-89db-f7f3de4aca2c · Exploit
• https://github.com/pimcore/pimcore · Nota
• https://github.com/pimcore/pimcore/security/advisories/GHSA-r7mm-jx6h-hv7m · Nota
• https://github.com/pimcore/pimcore/commit/a4491551967d879141a3fdf0986a9dd3d891abfe · Correção
• https://t.me/cvedetector/11063 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1857381718375977452 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1857448356781428921 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-2332 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-r7mm-jx6h-hv7m · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-2332 · Aviso do Fabricante