GHSA-r7mm-jx6h-hv7m

Cross-site Scripting (XSS) in Conditions tab of Pricing Rules

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-2332

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	pimcore/pimcore	< 10.5.21	10.5.21

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. ### Patches Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/a4491551967d879141a3fdf0986a9dd3d891abfe.patch ### Workarounds Apply patch https://github.com/pimcore/pimcore/commit/a4491551967d879141a3fdf0986a9dd3d891abfe.patch manually. ### References https://huntr.dev/bounties/e436ed71-6741-4b30-89db-f7f3de4aca2c/

References

External links from the advisory. They lead to third-party sites.

https://github.com/pimcore/pimcore/security/advisories/GHSA-r7mm-jx6h-hv7m web
https://nvd.nist.gov/vuln/detail/CVE-2023-2332 advisory
https://github.com/pimcore/pimcore/commit/a4491551967d879141a3fdf0986a9dd3d891abfe web
https://github.com/pimcore/pimcore package
https://huntr.com/bounties/e436ed71-6741-4b30-89db-f7f3de4aca2c web