CVE-2023-46722: Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews
First published: Tue Oct 31 2023(Updated: )
### Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Proof of Concept Step 1. Go to /admin and login. Step 2. In Documents, go to home -> click on Sample Content -> click Document folder Step 3. Upload file PDF content XSS payload ### Patches Apply patches https://github.com/pimcore/pimcore/commit/757375677dc83a44c6c22f26d97452cc5cda5d7c.patch https://github.com/pimcore/admin-ui-classic-bundle/commit/19fda2e86557c2ed4978316104de5ccdaa66d8b9.patch ### Workarounds Update to version 1.2.0 or apply patches manually https://github.com/pimcore/pimcore/commit/757375677dc83a44c6c22f26d97452cc5cda5d7c.patch https://github.com/pimcore/admin-ui-classic-bundle/commit/19fda2e86557c2ed4978316104de5ccdaa66d8b9.patch
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pimcore Admin Classic Bundle | <1.2.0 | |
| composer/pimcore/admin-ui-classic-bundle | <1.2.0 | 1.2.0 |
Remedy
https://github.com/pimcore/admin-ui-classic-bundle/commit/19fda2e86557c2ed4978316104de5ccdaa66d8b9
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/pimcore/admin-ui-classic-bundle/commit/19fda2e86557c2ed4978316104de5ccdaa66d8b9
- https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-jfxw-6c5v-c42f
- https://github.com/pimcore/pimcore/commit/757375677dc83a44c6c22f26d97452cc5cda5d7c
- https://nvd.nist.gov/vuln/detail/CVE-2023-46722
- https://github.com/advisories/GHSA-jfxw-6c5v-c42f (Advisory)
Frequently Asked Questions
What is the vulnerability CVE-2023-46722?
CVE-2023-46722 is a vulnerability in Pimcore Admin Classic Bundle that allows for cross-site scripting (XSS) attacks in PDF previews.
What is the impact of CVE-2023-46722?
The vulnerability has the potential to steal user cookies and gain unauthorized access to user accounts or redirect users to malicious sites.
How can an attacker exploit CVE-2023-46722?
An attacker can exploit CVE-2023-46722 by injecting malicious scripts into PDF previews, which can then execute in a user's browser.
How do I fix CVE-2023-46722?
To fix CVE-2023-46722, update to version 1.2.0 of the Pimcore Admin Classic Bundle package.
What are the Common Weakness Enumeration (CWE) IDs associated with CVE-2023-46722?
The CWE IDs associated with CVE-2023-46722 are CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page) and CWE-79 (Improper Neutralization of Input During Web Page Generation).
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-jfxw-6c5v-c42f
- alias/CVE-2023-46722
- collector/nvd-cve
- collector/github-advisory
- agent/references
- agent/title
- agent/type
- agent/event
- agent/severity
- agent/weakness
- agent/author
- agent/description
- agent/first-publish-date
- agent/softwarecombine
- agent/remedy
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/pimcore
- canonical/pimcore admin classic bundle
- package-manager/composer