GHSA-qxcw-rf4v-hp26

Pimcore vulnerable to Cross Site Scripting in image/video thumbnail config

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-1117

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	pimcore/pimcore	< 10.5.18	10.5.18

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact An attacker can use XSS to send a malicious script to any user through Image/Video thumbnail config ### Patches Update to version 10.5.18 or apply this patch manually https://github.com/pimcore/pimcore/pull/14472.patch ### Workarounds Apply https://github.com/pimcore/pimcore/pull/14472.patch manually. ### References https://huntr.dev/bounties/e8c0044d-a31b-4347-b2d5-59fbf492da39/

References

External links from the advisory. They lead to third-party sites.

https://github.com/pimcore/pimcore/security/advisories/GHSA-qxcw-rf4v-hp26 web
https://nvd.nist.gov/vuln/detail/CVE-2023-1117 advisory
https://github.com/pimcore/pimcore/commit/b9ba69f66d6a9986fb36f239661b98cd33a89853 web
https://github.com/pimcore/pimcore package
https://huntr.dev/bounties/e8c0044d-a31b-4347-b2d5-59fbf492da39 web