CVE-2023-2341: Cross-site Scripting (XSS) - Generic in pimcore/pimcore
First published: Thu Apr 27 2023(Updated: )
### Impact Malicious JavaScript has access to all the same objects as the rest of the web page, including access to cookies and local storage, which are often used to store session tokens. If an attacker can obtain a user's session cookie, they can then impersonate that user. Furthermore, JavaScript can read and make arbitrary modifications to the contents of a page being displayed to a user. Therefore, XSS in conjunction with some clever social engineering opens up a lot of possibilities for an attacker. ### Patches Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/66f1089fb1b9bcd575bfce9b1d4abb0f0499df11.patch ### Workarounds Apply patch https://github.com/pimcore/pimcore/commit/66f1089fb1b9bcd575bfce9b1d4abb0f0499df11.patch manually. ### References https://huntr.dev/bounties/cf3901ac-a649-478f-ab08-094ef759c11d/
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/pimcore/pimcore | <10.5.21 | 10.5.21 |
| Pimcore E-commerce Framework | <10.5.21 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/pimcore/pimcore/security/advisories/GHSA-fq95-rx4q-qgg2
- https://nvd.nist.gov/vuln/detail/CVE-2023-2341
- https://github.com/pimcore/pimcore/commit/66f1089fb1b9bcd575bfce9b1d4abb0f0499df11
- https://huntr.dev/bounties/cf3901ac-a649-478f-ab08-094ef759c11d
- https://github.com/advisories/GHSA-fq95-rx4q-qgg2 (Advisory)
Frequently Asked Questions
What is CVE-2023-2341?
CVE-2023-2341 is a vulnerability known as Cross-site Scripting (XSS) - Generic in the GitHub repository pimcore/pimcore prior to version 10.5.21.
What is the impact of CVE-2023-2341?
The impact of CVE-2023-2341 is that malicious JavaScript can access cookies and local storage, potentially allowing an attacker to impersonate the user.
How can an attacker exploit CVE-2023-2341?
An attacker can exploit CVE-2023-2341 by injecting malicious JavaScript code into a vulnerable web page, which is then executed by the victim's browser.
How do I fix CVE-2023-2341?
To fix CVE-2023-2341, update the pimcore/pimcore repository to version 10.5.21 or higher.
Where can I find more information about CVE-2023-2341?
You can find more information about CVE-2023-2341 on the GitHub security advisories page (https://github.com/pimcore/pimcore/security/advisories/GHSA-fq95-rx4q-qgg2) and the NIST NVD page (https://nvd.nist.gov/vuln/detail/CVE-2023-2341).
- collector/github-advisory-latest
- alias/GHSA-fq95-rx4q-qgg2
- alias/CVE-2023-2341
- collector/github-advisory
- agent/author
- agent/type
- agent/remedy
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/weakness
- agent/title
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/description
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- package-manager/composer
- vendor/pimcore
- canonical/pimcore e-commerce framework