GHSA-f2jh-mf2c-8278

Pimcore vulnerable to Cross-site Scripting

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-1067

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	pimcore/pimcore	<= 10.5.17	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore 10.5.17 and prior. A patch is available and anticipated to be part of 10.5.18.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-1067 advisory
https://github.com/pimcore/pimcore/commit/4b5733266d7d6aeb4f221a15e005db83fc198edf web
https://github.com/pimcore/pimcore package
https://huntr.dev/bounties/31d17b34-f80d-49f2-86e7-97ae715cc045 web