What is GHSA-96hp-38wx-j3wc?

GHSA-96hp-38wx-j3wc is a security advisory published by GitHub Security Advisories with Medium severity. Pimcore vulnerable to Cross Site Scripting in Email Blacklist

Which CVE IDs does GHSA-96hp-38wx-j3wc cover?

GHSA-96hp-38wx-j3wc covers the following CVE IDs: CVE-2023-1116. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-96hp-38wx-j3wc?

GHSA-96hp-38wx-j3wc has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-96hp-38wx-j3wc?

GHSA-96hp-38wx-j3wc affects 1 product, including: composer/pimcore/pimcore:\u003c 10.5.18.

GHSA-96hp-38wx-j3wcMediumCVSS 5.4

Pimcore vulnerable to Cross Site Scripting in Email Blacklist

Vendor

GitHub Security Advisories

Published

March 1, 2023

Last Modified

March 6, 2023

🔗 CVE IDs covered (1)

CVE-2023-1116 →

📋 Description

Impact

The attacker can execute arbitrary JavaScript and steal Cookies information and use them to hijack the user's session.

Patches

Update to version 10.5.18 or apply this patch manually https://github.com/pimcore/pimcore/pull/14467.patch

Workarounds

Apply https://github.com/pimcore/pimcore/pull/14467.patch manually.

References

https://huntr.dev/bounties/3245ff99-9adf-4db9-af94-f995747e09d1/

🎯 Affected products1

composer/pimcore/pimcore:< 10.5.18

🔗 References (6)

https://github.com/pimcore/pimcore/security/advisories/GHSA-96hp-38wx-j3wc
https://nvd.nist.gov/vuln/detail/CVE-2023-1116
https://github.com/pimcore/pimcore/pull/14467.patch
https://github.com/pimcore/pimcore/commit/f6d322efa207a737eedd8726b7c92e957a83341e
https://huntr.dev/bounties/3245ff99-9adf-4db9-af94-f995747e09d1
https://github.com/advisories/GHSA-96hp-38wx-j3wc