CVE-2021-39170: Improper Encoding or Escaping of Output in Asset Metadata Component
Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a value of custom metadata on assets. There is a patch for this issue in Pimcore version 10.1.2. As a workaround, users may apply the patch manually.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pimcoreto a version that resolves this vulnerability.Fixed in 10.1.2
Event History
Frequently Asked Questions
What is the severity of CVE-2021-39170?
CVE-2021-39170 is classified as a high severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2021-39170?
To fix CVE-2021-39170, upgrade to Pimcore version 10.1.2 or apply the patch manually if an upgrade is not possible.
Who is affected by CVE-2021-39170?
CVE-2021-39170 affects users of Pimcore versions prior to 10.1.2 who have the ability to add custom metadata to assets.
What is the impact of CVE-2021-39170?
The impact of CVE-2021-39170 includes the possibility for an attacker to execute arbitrary JavaScript code in the context of a user's session.
Is there a workaround for CVE-2021-39170?
Yes, users may manually apply the patch as a temporary workaround until they can upgrade to the fixed version.