PT-2023-25880 · Pimcore · Pimcore Admin Classic Bundle

Hackeruniverse · Published 2023-07-11 · Updated 2023-07-19 · CVE-2023-37280

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Pimcore Admin Classic Bundle versions prior to 1.0.3

Description The issue allows for unauthenticated HTML injection or cross-site scripting (XSS), affecting admins who have not set up two-factor authentication. This can cause the application to execute arbitrary scripts or HTML content. The vulnerable endpoint is "/admin/login/2fa-setup" with the vulnerable parameter error. An attacker could replace the QR code on the 2fa page, increasing the threat to admins. This attack can lead to cookie stealing, defacement, or injecting phishing URLs on the target application.

Recommendations Update to version 1.0.3 to resolve the issue. As a temporary workaround, consider applying the patches manually from the provided GitHub commit. Restrict access to the vulnerable endpoint "/admin/login/2fa-setup" and avoid using the error parameter in this endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-37280

GHSA-HQV9-6JQW-9G8M

Affected Products

Pimcore Admin Classic Bundle

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37280.json · Exploit
• https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-hqv9-6jqw-9g8m · Vendor Advisory
• https://github.com/pimcore/admin-ui-classic-bundle/pull/147 · Patch
• https://github.com/pimcore/admin-ui-classic-bundle/commit/5fcd19bdc89a3fe4cb8ad8c356590e1e4740c743 · Patch
• https://osv.dev/vulnerability/CVE-2023-37280 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37280 · Security Note
• https://osv.dev/vulnerability/GHSA-hqv9-6jqw-9g8m · Vendor Advisory
• https://github.com/pimcore/admin-ui-classic-bundle · Note
• https://huntr.dev/bounties/1fa1cc3b-75ff-4d34-99ae-4a705eb623e7 · Note