Cross-site Scripting (XSS) in Conditions tab of Pricing Rules

보통 4.8CVE-2023-2332 · GHSA-r7mm-jx6h-hv7m · Published 15/11/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
pimcore/pimcore Packagist	`< 10.5.21`	`10.5.21`
pimcore pimcore	`= 10.5.19`	No fix yet

Description

Impact

This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

NVD description

A stored Cross-site Scripting (XSS) vulnerability exists in the Conditions tab of Pricing Rules in pimcore/pimcore versions 10.5.19. The vulnerability is present in the From and To fields of the Date Range section, allowing an attacker to inject malicious scripts. This can lead to the execution of arbitrary JavaScript code in the context of the user's browser, potentially stealing cookies or redirecting users to malicious sites. The issue is fixed in version 10.5.21.

References

pimcore/pimcore security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2023-2332 · ADVISORY
pimcore/pimcore commit a449155 · WEB
pimcore/pimcore · PACKAGE
huntr.com/bounties/e436ed71-6741-4b30-89db-f7f3de4aca2c · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

pimcore/pimcore

Packagist

< 10.5.21

10.5.21

pimcore

= 10.5.19

No fix yet

Description

NVD description

Description

Impact

Patches

Workarounds

References

References

Description

Impact

Patches

Workarounds

References

References