CVE-2023-4145: Cross-site Scripting vulnerability in pimcore/customer-management-framework-bundle
Summary
CVE-2023-4145: pimcore/customer-management-framework-bundle Cross-site Scripting vulnerability in Segment name. Affects pimcore/customer-management-framework-bundle versions < 3.4.2. Fixed in 3.4.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pimcore/customer-management-framework-bundle is a package available on Packagist. It is used for customer management within the Pimcore framework. This bundle provides various features and functionalities related to customer data management. However, it is susceptible to a Cross-site Scripting (XSS) vulnerability in the Segment name field.
Vulnerability Detail
The XSS vulnerability in the Segment name field allows an attacker to inject malicious HTML code, which can be executed when a victim interacts with the affected application. This can be exploited through email communication, where the attacker tricks the victim into clicking on a hyperlink that redirects them to a malicious site or hosts a XSS page. The impact of this vulnerability can lead to users unknowingly giving away their login credentials to malicious attackers, resulting in potential unauthorized access to sensitive information. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.5.
How To Fix
Minimum fixed version
3.4.2
This is the first release that contains the fix.
composer require pimcore/customer-management-framework-bundle:3.4.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating or applying the patch is not immediately feasible, a temporary workaround can be implemented by manually applying the patch provided in the link mentioned above.
Conclusion
In conclusion, the pimcore/customer-management-framework-bundle is vulnerable to a Cross-site Scripting (XSS) vulnerability in the Segment name field. It is crucial to update the package to version 3.4.2 or apply the provided patch to mitigate the risk of unauthorized access and potential data breaches. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pimcore/customer-management-framework-bundle →
FAQ
The impact of this vulnerability includes the potential for users to be tricked into clicking on malicious hyperlinks, leading to unauthorized access to sensitive information and the possibility of hosting a XSS page.
To fix this vulnerability, update the pimcore/customer-management-framework-bundle to version 3.4.2 or manually apply the provided patch.
Yes, a temporary workaround can be implemented by manually applying the patch provided in the link mentioned above.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.5.
More information about this vulnerability can be found at the following link: https://huntr.dev/bounties/ce852777-2994-40b4-bb4e-c4d10023eeb0/
References
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/customer-management-framework-bundle.
