CVE-2021-39166 Improper Neutralization of Text-Values in Object Version Preview

What is CVE-2021-39166?

CVE-2021-39166 is a high-severity cross-site scripting vulnerability in Pimcore Pimcore, published on 1 Sep 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources. This issue is patched in Pimcore version 10.1.2.

Weakness: CWE-79

Which versions are affected by CVE-2021-39166?

2 open source packages ship an affected version, including pimcore/pimcore. It affects 1 product.

Products include Pimcore Pimcore.

How do I fix CVE-2021-39166?

Upgrade pimcore/pimcore to 10.1.2 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-39166 being exploited?

There is no known exploitation of CVE-2021-39166 in the wild and no public exploit code.

Other vulnerabilities in Pimcore Pimcore

• CVE-2022-39365 RCE vulnerability in Pimcore/Mail & Dynamic Text Layout Critical 9.8
• CVE-2019-18981 Pimcore Access Control Issues Critical 9.8
• CVE-2019-18985 Pimcore 2FA Vulnerable to Brute Forcing Critical 9.8
• CVE-2026-23492 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848 High 8.8
• CVE-2023-47637 SQL Injection in Admin Grid Filter API in Pimcore High 8.8

All Pimcore Pimcore vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w6j8-jc36-x5q9.