GHSA-pc32-x737-74cv

ghsaUSosv

Cross-site Scripting in Pimcore

view advisory published 2022-03-17Licence: CC-BY-4.0

Pimcore 10.3.3 and prior is vulnerable to stored cross-site scripting. A patch is available on the 10.x branch and will likely be part of version 10.4.0.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-0704US	medium5.4	1.30% (70th)	—	2022-03-16
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.

references

External citations — patches, advisories, analysis.

https://github.com/pimcore/pimcorePACKAGE
https://github.com/pimcore/pimcore/commit/6e0922c5b2959ac1b48500ac508d8fc5a97286f9WEB
https://github.com/pimcore/pimcore/pull/11447WEB
https://huntr.dev/bounties/4142a8b4-b439-4328-aaa3-52f6fedfd0a6WEB
https://nvd.nist.gov/vuln/detail/CVE-2022-0704ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan