Duplicate Advisory: Pimcore Cross-site Scripting (XSS) in Static Routes name field
Summary
GHSA-g947-422m-hr7p: Duplicate Advisory: Pimcore Cross-site Scripting (XSS) in Static Routes name field. Affects pimcore/pimcore versions < 10.5.21. Fixed in 10.5.21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pimcore is an open-source content management system (CMS) and product information management (PIM) platform. It is widely used for creating and managing digital experiences, including websites, mobile apps, and e-commerce platforms. The vulnerability in question is a Cross-site Scripting (XSS) issue that affects the name field in static routes within the Pimcore repository. This vulnerability allows an attacker to inject malicious scripts into web pages viewed by users, potentially leading to unauthorized access, data theft, or other malicious activities.
Vulnerability Detail
The Cross-site Scripting (XSS) vulnerability in Pimcore arises from improper input sanitization in the name field of static routes. This allows an attacker to inject arbitrary JavaScript code into web pages viewed by users. When a user interacts with the affected page, the injected code is executed within their browser, leading to potential security risks. The vulnerability has a CVSS score of 6.8, indicating a moderate severity level.
How To Fix
Minimum fixed version
10.5.21
This is the first release that contains the fix.
composer require pimcore/pimcore:10.5.21Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As this vulnerability has a fix available, it is recommended to apply the upgrade rather than relying on a workaround. However, if upgrading is not immediately feasible, a temporary workaround is to manually sanitize user input in the name field of static routes. This can be achieved by implementing input validation and filtering techniques to remove or neutralize any potentially malicious scripts. It is crucial to thoroughly test the workaround to ensure it effectively mitigates the vulnerability.
Conclusion
In conclusion, the Pimcore Cross-site Scripting (XSS) vulnerability in the name field of static routes poses a moderate security risk. It is crucial to promptly upgrade to the latest version of Pimcore (10.5.21 or later) to mitigate this vulnerability and ensure the security of your application. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pimcore/pimcore →
FAQ
Pimcore is an open-source content management system (CMS) and product information management (PIM) platform used for creating and managing digital experiences.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users.
The potential risks of this vulnerability include unauthorized access, data theft, and the execution of malicious activities within a user's browser.
The CVSS score of this vulnerability is 6.8, indicating a moderate severity level.
To fix this vulnerability, it is recommended to upgrade to Pimcore version 10.5.21 or later.
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/pimcore.
