Moderate severityNVD Advisory· Published Oct 31, 2023· Updated Sep 5, 2024
Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews
CVE-2023-46722
Description
The Pimcore Admin Classic Bundle provides a backend UI for Pimcore. Prior to version 1.2.0, a cross-site scripting vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 1.2.0 to receive a patch or, as a workaround, apply the patch manually.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
pimcore/admin-ui-classic-bundlePackagist | < 1.2.0 | 1.2.0 |
Affected products
2- Range: < 1.2.0
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-jfxw-6c5v-c42fghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-46722ghsaADVISORY
- github.com/pimcore/admin-ui-classic-bundle/commit/19fda2e86557c2ed4978316104de5ccdaa66d8b9ghsax_refsource_MISCWEB
- github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-jfxw-6c5v-c42fghsax_refsource_CONFIRMWEB
- github.com/pimcore/pimcore/commit/757375677dc83a44c6c22f26d97452cc5cda5d7cghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.