Stored XSS vulnerability in Pricing Rules (pimcore versions 10.5.19 and lower)

CVE-2023-2332

Summary

A stored Cross-site Scripting (XSS) vulnerability is identified in the Conditions tab of Pricing Rules within Pimcore versions 10.5.19. This flaw resides in the From and To fields of the Date Range section, permitting an attacker to input malicious scripts. By exploiting this weakness, a threat actor could execute arbitrary JavaScript code within the user's browser session. Such exploitation can result in the theft of sensitive information, such as cookies, or redirect users to harmful or malicious websites. The vulnerability has been addressed in Pimcore version 10.5.21, emphasizing the importance of keeping software up to date to mitigate potential risks.

References