What is GHSA-hfmg-g39c-5444?

GHSA-hfmg-g39c-5444 is a security advisory published by GitHub Security Advisories with Medium severity. pimcore is vulnerable to cross-site scripting in translate module

Which CVE IDs does GHSA-hfmg-g39c-5444 cover?

GHSA-hfmg-g39c-5444 covers the following CVE IDs: CVE-2023-1704. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-hfmg-g39c-5444?

GHSA-hfmg-g39c-5444 affects 1 product, including: composer/pimcore/pimcore:\u003c 10.5.20.

GHSA-hfmg-g39c-5444Medium

pimcore is vulnerable to cross-site scripting in translate module

Vendor

GitHub Security Advisories

Published

March 31, 2023

Last Modified

April 2, 2023

🔗 CVE IDs covered (1)

CVE-2023-1704 →

📋 Description

Impact

This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

Patches

Update to version 10.5.20 or apply this patch manually https://github.com/pimcore/pimcore/pull/14732.patch

Workarounds

Apply https://github.com/pimcore/pimcore/pull/14732.patch manually.

References

https://huntr.dev/bounties/84419c7b-ae29-401b-bdfd-5d0c498d320f/

🎯 Affected products1

composer/pimcore/pimcore:< 10.5.20

🔗 References (6)

https://github.com/pimcore/pimcore/security/advisories/GHSA-hfmg-g39c-5444
https://nvd.nist.gov/vuln/detail/CVE-2023-1704
https://github.com/pimcore/pimcore/pull/14732.patch
https://github.com/pimcore/pimcore/commit/295f5e8d108b68198e36399bea0f69598eb108a0
https://huntr.dev/bounties/84419c7b-ae29-401b-bdfd-5d0c498d320f
https://github.com/advisories/GHSA-hfmg-g39c-5444