CVE-2023-4453: Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.
Patches Update to version 10.6.8 or apply this patch manually https://github.com/pimcore/pimcore/commit/234c0c02ea7502071b00ab673fbe4a6ac253080e.patch
Workarounds Apply patch https://github.com/pimcore/pimcore/commit/234c0c02ea7502071b00ab673fbe4a6ac253080e.patch manually.
References https://huntr.dev/bounties/245a8785-0fc0-4561-b181-fa20f869d993/
Other sources
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.8.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-4453?
CVE-2023-4453 is a vulnerability in the Pimcore CMS that allows for cross-site scripting (XSS) attacks.
How does CVE-2023-4453 impact users?
CVE-2023-4453 has the potential to steal a user's cookie and gain unauthorized access to their account or redirect them to malicious sites.
What is the severity of CVE-2023-4453?
CVE-2023-4453 has a severity rating of medium with a score of 5.4.
How can I fix CVE-2023-4453?
To fix CVE-2023-4453, update your Pimcore CMS to version 10.6.8 or apply the provided patch manually.
Where can I find more information about CVE-2023-4453?
You can find more information about CVE-2023-4453 in the references provided: [link1], [link2], [link3].