GHSA-96hp-38wx-j3wc

ghsaUSosv

Pimcore vulnerable to Cross Site Scripting in Email Blacklist

view advisory published 2023-03-01Licence: CC-BY-4.0

### Impact The attacker can execute arbitrary JavaScript and steal Cookies information and use them to hijack the user's session. ### Patches Update to version 10.5.18 or apply this patch manually https://github.com/pimcore/pimcore/pull/14467.patch ### Workarounds Apply https://github.com/pimcore/pimcore/pull/14467.patch manually. ### References https://huntr.dev/bounties/3245ff99-9adf-4db9-af94-f995747e09d1/

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-1116US	medium5.4	0.51% (43rd)	—	2023-03-01
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.

references

External citations — patches, advisories, analysis.

https://github.com/pimcore/pimcorePACKAGE
https://github.com/pimcore/pimcore/commit/f6d322efa207a737eedd8726b7c92e957a83341eWEB
https://github.com/pimcore/pimcore/pull/14467.patchWEB
https://github.com/pimcore/pimcore/security/advisories/GHSA-96hp-38wx-j3wcWEB
https://huntr.dev/bounties/3245ff99-9adf-4db9-af94-f995747e09d1WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-1116ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan