CVE-2019-18982: XSS
bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header.
Other sources
bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-18982?
CVE-2019-18982 has been classified as a medium severity vulnerability.
How do I fix CVE-2019-18982?
To fix CVE-2019-18982, upgrade to Pimcore version 6.3.0 or later.
What types of attacks can exploit CVE-2019-18982?
CVE-2019-18982 can be exploited to execute malicious scripts through the Email Log preview window.
Which versions of Pimcore are affected by CVE-2019-18982?
Pimcore versions prior to 6.3.0 are affected by CVE-2019-18982.
Is a Content-Security-Policy header required to mitigate CVE-2019-18982?
Yes, implementing a Content-Security-Policy header is necessary to mitigate CVE-2019-18982.