Reflected XSS in Application Logger module - pimcore/pimcore
Summary
GHSA-2xpm-cmvw-3jcc: Reflected XSS in Application Logger module. Affects pimcore/pimcore versions < 10.5.19. Fixed in 10.5.19. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pimcore is an open-source content management system (CMS) and digital experience platform (DXP) that provides a wide range of features for building and managing websites, e-commerce platforms, and other digital applications. The Application Logger module in Pimcore is responsible for logging application events and activities. However, a vulnerability has been discovered in this module that allows for reflected cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in the Application Logger module of Pimcore allows an attacker to inject malicious code into the application, which is then executed in the context of the user's browser. This can lead to various security risks, including the theft of user cookies, unauthorized access to user accounts, or redirection to malicious websites. The vulnerability has a CVSS score of 4.8, indicating a moderate severity level. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-79.
How To Fix
Minimum fixed version
10.5.19
This is the first release that contains the fix.
composer require pimcore/pimcore:10.5.19Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating or applying the patch is not immediately feasible, you can apply the patch manually by following the instructions in the patch file available at https://github.com/pimcore/pimcore/pull/14606.patch.
Conclusion
In conclusion, the Application Logger module in the Pimcore package is vulnerable to reflected XSS attacks. It is crucial to update to version 10.5.19 or apply the provided patch to mitigate this vulnerability. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pimcore/pimcore →
FAQ
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.
You can fix this vulnerability by updating to version 10.5.19 of the Pimcore package or manually applying the provided patch.
Yes, if updating or applying the patch is not immediately feasible, you can manually apply the patch by following the instructions in the provided patch file.
This vulnerability has a CVSS score of 4.8, indicating a moderate severity level.
Yes, you can find more information about this vulnerability at https://huntr.dev/bounties/2a64a32d-b1cc-4def-91da-18040d59f356/
References
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/pimcore.
