CVE-2023-42817: Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translations
First published: Mon Sep 25 2023(Updated: )
### Impact The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user. The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box. ### Patches https://github.com/pimcore/admin-ui-classic-bundle/commit/abd7739298f974319e3cac3fd4fcd7f995b63e4c.patch ### Workarounds Update to version 1.1.2 or apply this patches manually https://github.com/pimcore/admin-ui-classic-bundle/commit/abd7739298f974319e3cac3fd4fcd7f995b63e4c.patch
Credit: security-advisories@github.com security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/pimcore/admin-ui-classic-bundle | <1.1.2 | 1.1.2 |
| Pimcore Admin Classic Bundle | <1.1.2 |
Remedy
https://github.com/pimcore/admin-ui-classic-bundle/commit/abd7739298f974319e3cac3fd4fcd7f995b63e4c
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-42817.
What is the impact of this vulnerability?
The translation value with text including "%s" is parsed by sprintf() even though it's supposed to be output literally to the user, allowing access to translations by users with lower overall access.
What is the severity rating of this vulnerability?
The severity rating of this vulnerability is medium with a CVSS score of 5.4.
What software is affected by this vulnerability?
The Pimcore admin-ui-classic-bundle package version up to 1.1.2 is affected by this vulnerability.
How do I fix the vulnerability (CVE-2023-42817)?
To fix the vulnerability, update the Pimcore admin-ui-classic-bundle package to version 1.1.2 or above.
- collector/nvd-api
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-m988-7375-7g2c
- alias/CVE-2023-42817
- collector/nvd-cve
- collector/github-advisory
- agent/type
- agent/references
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/author
- agent/remedy
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/description
- agent/event
- vendor/pimcore
- canonical/pimcore admin classic bundle
- package-manager/composer