PT-2022-4440 · Pimcore · Pimcore

Published 2022-08-07 · Updated 2022-08-24 · CVE-2022-2796

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pimcore versions prior to 10.5.4

Description The issue is related to a stored Cross-site Scripting (XSS) in the pimcore/pimcore GitHub repository. This occurs due to inadequate protection of the web page structure, allowing a remote attacker to conduct an XSS attack.

Recommendations For versions prior to 10.5.4, update to version 10.5.4 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-05304

CVE-2022-2796

GHSA-PR4F-4PCX-2R3H

Affected Products

Pimcore

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2796.json · Exploit
• 🔥 https://huntr.dev/bounties/69d56ec3-8370-44cf-9732-4065e3076097 · Exploit
• https://github.com/pimcore/pimcore/commit/2fd46859c1def6b5ab79ae2b9cb88c309769443d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-2796 · Security Note
• https://osv.dev/vulnerability/GHSA-pr4f-4pcx-2r3h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2796 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05304 · Security Note
• https://github.com/pimcore/pimcore · Note