~ / search / GHSA-2v88-qq7x-xq5f

GHSA-2v88-qq7x-xq5f

Improper Encoding or Escaping of Output in Asset Metadata Component

Source: GitHub Advisory Database (reviewed) High CVE-2021-39170

Packages

EcosystemPackageAffectedFixed in
Packagist pimcore/pimcore < 10.1.2 10.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a value of custom metadata on assets. There is a patch for this issue in Pimcore version 10.1.2. As a workaround, users may apply the patch manually.

References

External links from the advisory. They lead to third-party sites.