GHSA-4849-x3jx-45qr
Pimcore vulnerable to stored stored Cross-site Scripting via`properties` when creating new users
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | pimcore/pimcore | < 10.5.6 | 10.5.6 |
Details
As written in the advisory (Markdown source, shown as plain text).
Pimcore prior to 10.5.6 is vulnerable to stored cross-site scripting. This occurs when an attacker injects a payload when adding properties for a new user.
References
External links from the advisory. They lead to third-party sites.