CVE-2023-2340: Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Impact The attacker is capable to stolen the user session cookie. it will leads to complete account takeover.
Patches Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/aa38319e353cc3cdfac12e03e21ed7a8f3628d3e.patch
Workarounds Apply patch https://github.com/pimcore/pimcore/commit/aa38319e353cc3cdfac12e03e21ed7a8f3628d3e.patch manually.
References https://huntr.dev/bounties/964762b0-b4fe-441c-81e1-0ebdbbf80f3b/
Other sources
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2023-2340.
What is the impact of the CVE-2023-2340 vulnerability?
The CVE-2023-2340 vulnerability allows an attacker to steal user session cookies, leading to a complete account takeover.
How can I fix the CVE-2023-2340 vulnerability?
To fix the CVE-2023-2340 vulnerability, update to version 10.5.21 of the pimcore/pimcore package or apply the patch manually.
What is the severity of the CVE-2023-2340 vulnerability?
The severity of the CVE-2023-2340 vulnerability is medium with a CVSS score of 5.4.
Where can I get more information about the CVE-2023-2340 vulnerability?
You can find more information about the CVE-2023-2340 vulnerability at the following references: [link1], [link2], [link3].