Pimcore Cross-site Scripting (XSS) Vulnerability in pimcore/pimcore
Summary
CVE-2019-18982: Pimcore Cross-site Scripting (XSS) vulnerability. Affects pimcore/pimcore versions < 6.3.0. Fixed in 6.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pimcore is an open-source content management system (CMS) and digital experience platform (DXP) that allows users to manage and deliver digital content across multiple channels. It provides a wide range of features and functionalities for building and managing websites, e-commerce platforms, and digital assets. However, a vulnerability has been identified in the Pimcore package, specifically in the bundles/AdminBundle/Controller/Admin/EmailController.php file prior to version 6.3.0. This vulnerability exposes a cross-site scripting (XSS) attack vector due to the absence of a Content-Security-Policy header.
Vulnerability Detail
The Pimcore XSS vulnerability allows an attacker to execute malicious scripts in the Email Log preview window. By exploiting this vulnerability, an attacker can inject and execute arbitrary JavaScript code, potentially leading to unauthorized access, data theft, or other malicious activities. The lack of a Content-Security-Policy header increases the risk of successful XSS attacks. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
6.3.0
This is the first release that contains the fix.
composer require pimcore/pimcore:6.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually add a Content-Security-Policy header to the affected file (bundles/AdminBundle/Controller/Admin/EmailController.php). The header should be set to a strict policy that prevents script execution from untrusted sources. Here is an example of a Content-Security-Policy header that can be added:
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';
This workaround should be implemented with caution and is not a substitute for upgrading to the latest version of the Pimcore package.
Conclusion
The Pimcore package prior to version 6.3.0 is vulnerable to a cross-site scripting (XSS) attack due to the absence of a Content-Security-Policy header. To mitigate this vulnerability, it is crucial to upgrade to version 6.3.0 or later. Alternatively, a temporary workaround can be implemented by manually adding a Content-Security-Policy header to the affected file. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pimcore/pimcore →
FAQ
Pimcore is an open-source content management system (CMS) and digital experience platform (DXP) used for managing and delivering digital content across various channels.
Cross-site scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to unauthorized access, data theft, or other malicious activities.
The Pimcore XSS vulnerability allows attackers to execute arbitrary JavaScript code in the Email Log preview window. This can lead to unauthorized access, data theft, or other malicious activities.
To fix the Pimcore XSS vulnerability, it is recommended to upgrade the Pimcore package to version 6.3.0 or later. This version includes the necessary Content-Security-Policy header to mitigate the vulnerability.
As a temporary workaround, users can manually add a Content-Security-Policy header to the affected file (bundles/AdminBundle/Controller/Admin/EmailController.php). However, this is not a substitute for upgrading to the latest version of the Pimcore package.
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/pimcore.
