What is GHSA-6qjm-39vh-729w?

GHSA-6qjm-39vh-729w is a security advisory published by GitHub Security Advisories with Medium severity. Pimcore Cross-site Scripting in Predefined Asset Metadata module in Settings

Which CVE IDs does GHSA-6qjm-39vh-729w cover?

GHSA-6qjm-39vh-729w covers the following CVE IDs: CVE-2023-1702. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-6qjm-39vh-729w?

GHSA-6qjm-39vh-729w affects 1 product, including: composer/pimcore/pimcore:\u003c 10.5.20.

GHSA-6qjm-39vh-729wMedium

Pimcore Cross-site Scripting in Predefined Asset Metadata module in Settings

Vendor

GitHub Security Advisories

Published

March 31, 2023

Last Modified

April 1, 2023

🔗 CVE IDs covered (1)

CVE-2023-1702 →

📋 Description

Impact

This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

Patches

Update to version 10.5.20 or apply this patch manually https://github.com/pimcore/pimcore/pull/14721.patch

Workarounds

Apply patch manually https://github.com/pimcore/pimcore/pull/14721.patch

References

https://huntr.dev/bounties/d8a47f29-3297-4fce-b534-e1d95a2b3e19

🎯 Affected products1

composer/pimcore/pimcore:< 10.5.20

🔗 References (6)

https://github.com/pimcore/pimcore/security/advisories/GHSA-6qjm-39vh-729w
https://nvd.nist.gov/vuln/detail/CVE-2023-1702
https://github.com/pimcore/pimcore/pull/14721.patch
https://github.com/pimcore/pimcore/commit/2b997737dd6a60be2239a51dd6d9ef5881568e6d
https://huntr.dev/bounties/d8a47f29-3297-4fce-b534-e1d95a2b3e19
https://github.com/advisories/GHSA-6qjm-39vh-729w