Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews
CVE-2023-46722

6.1MEDIUM

Key Information:

Vendor
Pimcore
Status
Admin-ui-classic-bundle
Vendor
CVE Published:
31 October 2023

Summary

The Pimcore Admin Classic Bundle provides a backend UI for Pimcore. Prior to version 1.2.0, a cross-site scripting vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 1.2.0 to receive a patch or, as a workaround, apply the patch manually.

Affected Version(s)

admin-ui-classic-bundle < 1.2.0

References

https://github.com/pimcore/admin-ui-classic-bundle/securi...
x_refsource_CONFIRM
https://github.com/pimcore/admin-ui-classic-bundle/commit...
x_refsource_MISC
https://github.com/pimcore/pimcore/commit/757375677dc83a4...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.