~ / search / GHSA-m4x3-xmjv-r778

GHSA-m4x3-xmjv-r778

Pimcore Cross-site Scripting (XSS) vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-18982

Packages

EcosystemPackageAffectedFixed in
Packagist pimcore/pimcore < 6.3.0 6.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

`bundles/AdminBundle/Controller/Admin/EmailController.php` in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header.

References

External links from the advisory. They lead to third-party sites.