CVE-2023-2342: Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.
Patches Update to version 10.5.21 or apply this patches manually https://github.com/pimcore/pimcore/commit/07a2c95be524c7e20105cef58c5767d4ebb06091.patch https://github.com/pimcore/pimcore/commit/42a5bbe5f16b97371fdbfdcf2bb3ee759dea8564.patch
Workarounds Apply patches manually: https://github.com/pimcore/pimcore/commit/07a2c95be524c7e20105cef58c5767d4ebb06091.patch https://github.com/pimcore/pimcore/commit/42a5bbe5f16b97371fdbfdcf2bb3ee759dea8564.patch
References https://huntr.dev/bounties/01cd3ed5-dce8-4021-9de0-81cb14bf1829/
Other sources
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-2342.
What is the impact of this vulnerability?
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.
How can I fix this vulnerability?
To fix this vulnerability, you need to update to version 10.5.21 of the pimcore/pimcore package.
What is the severity of CVE-2023-2342?
The severity of CVE-2023-2342 is medium.
What is the CWE ID for this vulnerability?
The CWE ID for this vulnerability is 79.