CVE-2023-2343: Cross-site Scripting (XSS) - DOM in pimcore/pimcore
Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.
Patches Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/f1d904094700b513c4756904fa2b1e19d08d890e.patch
Workarounds Apply patch https://github.com/pimcore/pimcore/commit/f1d904094700b513c4756904fa2b1e19d08d890e.patch manually.
References https://huntr.dev/bounties/2fa17227-a717-4b66-ab5a-16bffbb4edb2/
Other sources
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-2343.
What is the severity of CVE-2023-2343?
The severity of CVE-2023-2343 is medium with a severity value of 5.4.
What is the impact of CVE-2023-2343?
CVE-2023-2343 has the potential to steal a user's cookie and gain unauthorized access to that user's account or redirect users to other malicious sites.
How can I fix CVE-2023-2343?
To fix CVE-2023-2343, update to version 10.5.21 of pimcore/pimcore or apply the patch manually.
Where can I find more information about CVE-2023-2343?
You can find more information about CVE-2023-2343 in the following references: [GitHub Security Advisory](https://github.com/pimcore/pimcore/security/advisories/GHSA-9q7q-r54q-3f3g), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-2343), [GitHub Commit](https://github.com/pimcore/pimcore/commit/f1d904094700b513c4756904fa2b1e19d08d890e).