PT-2023-18930 · Pimcore · Pimcore

Published 2023-04-27 · Updated 2023-05-04 · CVE-2023-2341

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions pimcore/pimcore versions prior to 10.5.21

Description The issue allows malicious JavaScript to access all the same objects as the rest of the web page, including access to cookies and local storage, which are often used to store session tokens. This could enable an attacker to impersonate a user if they can obtain the user's session cookie. Furthermore, JavaScript can read and make arbitrary modifications to the contents of a page being displayed to a user, opening up possibilities for an attacker, especially when combined with social engineering.

Recommendations Update to version 10.5.21 or apply the patch manually from https://github.com/pimcore/pimcore/commit/66f1089fb1b9bcd575bfce9b1d4abb0f0499df11.patch to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and implementing additional security measures to minimize the risk of exploitation until the patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-2341

GHSA-FQ95-RX4Q-QGG2

Affected Products

Pimcore

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2341.json · Exploit
• 🔥 https://huntr.dev/bounties/cf3901ac-a649-478f-ab08-094ef759c11d · Exploit
• https://github.com/pimcore/pimcore/commit/66f1089fb1b9bcd575bfce9b1d4abb0f0499df11 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-2341 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2341 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fq95-rx4q-qgg2 · Vendor Advisory
• https://github.com/pimcore/pimcore · Note
• https://github.com/pimcore/pimcore/security/advisories/GHSA-fq95-rx4q-qgg2 · Note
• https://t.me/cibsecurity/62978 · Telegram Post