PT-2023-16766 · Pimcore · Pimcore
CVE-2023-1115
·
Publicado
2023-03-01
·
Atualizado
2023-03-04
CVSS v3.1
7.6
Alta
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
pimcore/pimcore versions prior to 10.5.18
Description
The issue is related to Cross-site Scripting (XSS) - Stored, which can be exploited by an attacker to send a malicious script to any user. This can be done through the Document Page Link Editable -> Advanced -> Attributes feature.
Recommendations
Update to version 10.5.18 or apply the patch manually from https://github.com/pimcore/pimcore/pull/14500.patch.
As a temporary workaround, consider applying the patch from https://github.com/pimcore/pimcore/pull/14500.patch manually to mitigate the risk.
Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Pimcore