CVE-2023-2323: Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.
Patches Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/e88fa79de7b5903fb58ddbc231130b04d937d79e.patch
Workarounds Apply patch https://github.com/pimcore/pimcore/commit/e88fa79de7b5903fb58ddbc231130b04d937d79e.patch manually.
References https://huntr.dev/bounties/41edf190-f6bf-4a29-a237-7ff1b2d048d3/
Other sources
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-2323?
CVE-2023-2323 is a vulnerability that allows for stored cross-site scripting (XSS) attacks in the GitHub repository pimcore/pimcore prior to version 10.5.21.
How severe is CVE-2023-2323?
CVE-2023-2323 has a severity score of 5.4, which is classified as medium.
How does CVE-2023-2323 affect Pimcore Pimcore?
CVE-2023-2323 affects Pimcore Pimcore versions prior to 10.5.21 and allows for stored cross-site scripting (XSS) attacks.
How can I fix CVE-2023-2323?
To fix CVE-2023-2323, update your Pimcore Pimcore installation to version 10.5.21 or later.
Where can I find more information about CVE-2023-2323?
You can find more information about CVE-2023-2323 in the GitHub repository pimcore/pimcore and on the huntr.dev page for this vulnerability.