PT-2025-1723

CVE-2024-11954

Published

2025-01-28

Updated

2025-11-04

Description by

CVSS 2.0

8.5

High

MetricsAV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Pimcore version 11.4.2

Description A problematic issue was found in the Search Document component, leading to basic cross site scripting. The manipulation can be launched remotely. The exploit has been disclosed to the public and may be used.

Recommendations Pimcore version 11.4.2: Update to a version that fixes the issue in the Search Document component to prevent basic cross site scripting.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Related identifiers