GHSA-pc32-x737-74cv

Cross-site Scripting in Pimcore

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-0704

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	pimcore/pimcore	< 10.4.0	10.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

Pimcore 10.3.3 and prior is vulnerable to stored cross-site scripting. A patch is available on the 10.x branch and will likely be part of version 10.4.0.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-0704 advisory
https://github.com/pimcore/pimcore/pull/11447 web
https://github.com/pimcore/pimcore/commit/6e0922c5b2959ac1b48500ac508d8fc5a97286f9 web
https://github.com/pimcore/pimcore package
https://huntr.dev/bounties/4142a8b4-b439-4328-aaa3-52f6fedfd0a6 web