PT-2025-5648 · Pimcore · Pimcore

Published 2025-01-28 · Updated 2025-01-28

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: PIMCORE (affected versions not specified)

Description: A Stored Cross-Site Scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the PDF upload functionality. This can result in the execution of malicious scripts in the context of the user's browser when the PDF is viewed, leading to potential session hijacking, defacement of web pages, or unauthorized access to sensitive information. The vulnerability is present in the PDF upload functionality of the PIM Core Upload module, where the application fails to properly sanitize the content, allowing embedded scripts to be executed when the PDF is viewed.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-XR3M-6GQ6-22CG

Affected Products

Pimcore

References · 5

• https://osv.dev/vulnerability/GHSA-xr3m-6gq6-22cg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11954 · Security Note
• https://github.com/pimcore/pimcore · Note
• https://github.com/pimcore/pimcore/security/advisories/GHSA-xr3m-6gq6-22cg · Note
• https://vuldb.com/?ctiid.293905 · Note