What is GHSA-fq8q-55v3-2986?

GHSA-fq8q-55v3-2986 is a security advisory published by GitHub Security Advisories with Medium severity. Pimcore Perspective Editor vulnerable to stored cross-site scripting (XSS) in perspective name

Which CVE IDs does GHSA-fq8q-55v3-2986 cover?

GHSA-fq8q-55v3-2986 covers the following CVE IDs: CVE-2023-28850. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fq8q-55v3-2986?

GHSA-fq8q-55v3-2986 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-fq8q-55v3-2986?

GHSA-fq8q-55v3-2986 affects 1 product, including: composer/pimcore/perspective-editor:\u003c 1.5.1.

GHSA-fq8q-55v3-2986MediumCVSS 6.1

Pimcore Perspective Editor vulnerable to stored cross-site scripting (XSS) in perspective name

Vendor

GitHub Security Advisories

Published

April 3, 2023

Last Modified

April 3, 2023

🔗 CVE IDs covered (1)

CVE-2023-28850 →

📋 Description

Impact

This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

Patches

Update to version 1.5.1.

Workarounds

Apply the patch https://github.com/pimcore/perspective-editor/pull/121.patch manually.

🎯 Affected products1

composer/pimcore/perspective-editor:< 1.5.1

🔗 References (5)

https://github.com/pimcore/perspective-editor/security/advisories/GHSA-fq8q-55v3-2986
https://nvd.nist.gov/vuln/detail/CVE-2023-28850
https://github.com/pimcore/perspective-editor/pull/121.patch
https://huntr.dev/bounties/5529f51e-e40f-46f1-887b-c9dbebab4f06/
https://github.com/advisories/GHSA-fq8q-55v3-2986