PT-2022-21361 · Pimcore+2 · Pimcore+1

Kingjia90 · Published 2022-09-21 · Updated 2022-09-23 · CVE-2022-3255

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions No specific software name is mentioned, but based on the information provided, the affected software is likely a web application. Since the affected versions are not explicitly mentioned, the output will be: Web application (affected versions not specified)

Description If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. The attacker can perform any action within the application that the user can perform, view any information that the user is able to view, modify any information that the user is able to modify, and initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-3255

GHSA-WQR6-57QM-HHR5

Affected Products

Pimcore

Pimcore/Pimcore

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3255.json · Exploit
• 🔥 https://huntr.dev/bounties/0ea45cf9-b256-454c-9031-2435294c0902 · Exploit
• https://github.com/pimcore/pimcore/commit/1e916e7d668c9e47b217e20cc0ea4812f466201b · Patch
• https://osv.dev/vulnerability/GHSA-wqr6-57qm-hhr5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3255 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3255 · Vendor Advisory
• https://github.com/pimcore/pimcore · Note
• https://t.me/cibsecurity/50194 · Telegram Post