CVE-2023-2341: Cross-site Scripting (XSS) - Generic in pimcore/pimcore
Impact Malicious JavaScript has access to all the same objects as the rest of the web page, including access to cookies and local storage, which are often used to store session tokens. If an attacker can obtain a user's session cookie, they can then impersonate that user.
Furthermore, JavaScript can read and make arbitrary modifications to the contents of a page being displayed to a user. Therefore, XSS in conjunction with some clever social engineering opens up a lot of possibilities for an attacker.
Patches Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/66f1089fb1b9bcd575bfce9b1d4abb0f0499df11.patch
Workarounds Apply patch https://github.com/pimcore/pimcore/commit/66f1089fb1b9bcd575bfce9b1d4abb0f0499df11.patch manually.
References https://huntr.dev/bounties/cf3901ac-a649-478f-ab08-094ef759c11d/
Other sources
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-2341?
CVE-2023-2341 is a vulnerability known as Cross-site Scripting (XSS) - Generic in the GitHub repository pimcore/pimcore prior to version 10.5.21.
What is the impact of CVE-2023-2341?
The impact of CVE-2023-2341 is that malicious JavaScript can access cookies and local storage, potentially allowing an attacker to impersonate the user.
How can an attacker exploit CVE-2023-2341?
An attacker can exploit CVE-2023-2341 by injecting malicious JavaScript code into a vulnerable web page, which is then executed by the victim's browser.
How do I fix CVE-2023-2341?
To fix CVE-2023-2341, update the pimcore/pimcore repository to version 10.5.21 or higher.
Where can I find more information about CVE-2023-2341?
You can find more information about CVE-2023-2341 on the GitHub security advisories page (https://github.com/pimcore/pimcore/security/advisories/GHSA-fq95-rx4q-qgg2) and the NIST NVD page (https://nvd.nist.gov/vuln/detail/CVE-2023-2341).