CVE-2023-4145: Cross-site Scripting (XSS) - Stored in pimcore/customer-data-framework
Impact As HTML injection works in email an attacker can trick a victim to click on such hyperlinks to redirect him to any malicious site and also can host a XSS page. All this will surely cause some damage to the victim. This could lead to users being tricked into giving logins away to malicious attackers.
Patches Update to version 3.4.2 or apply this patch manually https://github.com/pimcore/customer-data-framework/commit/72f45dd537a706954e7a71c99fbe318640e846a2.patch
Workarounds Apply https://github.com/pimcore/customer-data-framework/commit/72f45dd537a706954e7a71c99fbe318640e846a2.patch manually.
References https://huntr.dev/bounties/ce852777-2994-40b4-bb4e-c4d10023eeb0/
Other sources
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-4145.
What is the severity of CVE-2023-4145?
The severity of CVE-2023-4145 is medium with a severity value of 6.5.
How does Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/customer-data-framework prior to 3.… (CVE-2023-4145) impact users?
This vulnerability allows an attacker to trick users into clicking on malicious hyperlinks, leading to potential damage including giving away login information.
What software versions are affected by CVE-2023-4145?
The software versions affected by CVE-2023-4145 are prior to version 3.4.2 of the pimcore/customer-management-framework-bundle package and the Pimcore Customer Data Framework.
How can I fix the Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/customer-data-framework prior to 3.… (CVE-2023-4145) vulnerability?
To fix this vulnerability, ensure that you update to version 3.4.2 or later of the pimcore/customer-management-framework-bundle package and the Pimcore Customer Data Framework.