Cross-site Scripting in Pimcore Datahub

MEDIUM 4.8CVE-2022-0955 · BIT-pimcore-2022-0955 · GHSA-vc5r-xfc4-4x22 · Published 24/03/2022 · updated 17/06/2026

In short

CVE-2022-0955 is a MEDIUM (CVSS 4.8) vulnerability affecting pimcore/data-hub, data-hub (pimcore).
Chance of exploitation in the next 30 days (EPSS): 0.58%, higher than 47.8% of all vulnerabilities.
Fix: update to 1.2.4 or later.

Package	Affected versions	Patched versions
pimcore/data-hub Packagist	`< 1.2.4`	`1.2.4`
data-hub pimcore	`< 1.2.4`	`1.2.4`

Description

Pimcore Datahub prior to 1.2.4 is vulnerable to stored cross-site scripting. An admin user accessing Datahub triggers the attack, which may result in the user's cookie being stolen.

NVD description

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/data-hub prior to 1.2.4.

References

nvd.nist.gov/vuln/detail/CVE-2022-0955 · ADVISORY
pimcore/data-hub commit 15d5b57 · WEB
pimcore/data-hub · PACKAGE
huntr.dev/bounties/708971a6-1e6c-4c51-a411-255caeba51df · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free