PT-2021-22428

CVE-2021-39170

Published

2021-09-01

Updated

2021-09-09

Description by

CVSS 3.1

8.0

High

MetricsAV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 10.1.2

Description Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a value of custom metadata on assets.

Recommendations For versions prior to 10.1.2, update to version 10.1.2 to resolve the issue. As a temporary workaround, users may apply the patch manually.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-116: Improper Encoding or Escaping of Output

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2021-39170