CVE-2023-1117: Pimcore vulnerable to Cross Site Scripting in image/video thumbnail config
Summary
CVE-2023-1117: Pimcore vulnerable to Cross Site Scripting in image/video thumbnail config. Affects pimcore/pimcore versions < 10.5.18. Fixed in 10.5.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pimcore is an open-source content management system (CMS) and product information management (PIM) platform. It is widely used for creating and managing digital experiences, including websites, mobile apps, and e-commerce platforms. Pimcore allows users to configure image and video thumbnails for various purposes. However, a vulnerability in the thumbnail configuration feature allows an attacker to exploit cross-site scripting (XSS) and inject malicious scripts into the system.
Vulnerability Detail
The vulnerability in Pimcore's image/video thumbnail config feature enables an attacker to inject malicious scripts into the system. By exploiting this vulnerability, an attacker can send a crafted script to any user through the thumbnail configuration. When the user views the affected thumbnail, the malicious script executes in their browser, potentially leading to various security risks. This vulnerability has a CVSS score of 5.4 (Moderate severity).
How To Fix
Minimum fixed version
10.5.18
This is the first release that contains the fix.
composer require pimcore/pimcore:10.5.18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to immediately update or apply the patch, you can manually apply the patch by following the instructions in the patch file available at: Patch File.
Conclusion
In conclusion, Pimcore is vulnerable to a cross-site scripting (XSS) vulnerability in the image/video thumbnail config feature. This vulnerability can be mitigated by updating to version 10.5.18 or applying the provided patch. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pimcore/pimcore →
FAQ
Pimcore is an open-source content management system (CMS) and product information management (PIM) platform used for creating and managing digital experiences.
This vulnerability allows an attacker to inject malicious scripts into the system, potentially leading to various security risks.
You can fix this vulnerability by updating Pimcore to version 10.5.18 or manually applying the provided patch.
Yes, if you are unable to immediately update or apply the patch, you can manually apply the patch by following the instructions in the provided patch file.
You can find more information about this vulnerability in the official Pimcore security advisory: https://huntr.dev/bounties/e8c0044d-a31b-4347-b2d5-59fbf492da39/
References
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/pimcore.
