CVE-2023-28429 Pimcore has Cross-site Scripting vulnerability in DataObject tooltip field

What is CVE-2023-28429?

CVE-2023-28429 is a medium-severity cross-site scripting vulnerability in Pimcore Pimcore, published on 20 Mar 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 10.5.19 or, as a workaround, apply the patch manually.

Weakness: CWE-79

Which versions are affected by CVE-2023-28429?

2 open source packages ship an affected version, including pimcore/pimcore. It affects 1 product.

Products include Pimcore Pimcore.

How do I fix CVE-2023-28429?

Upgrade pimcore/pimcore to 10.5.19 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-28429 being exploited?

There is no known exploitation of CVE-2023-28429 in the wild and no public exploit code.

Other vulnerabilities in Pimcore Pimcore

• CVE-2022-39365 RCE vulnerability in Pimcore/Mail & Dynamic Text Layout Critical 9.8
• CVE-2019-18981 Pimcore Access Control Issues Critical 9.8
• CVE-2019-18985 Pimcore 2FA Vulnerable to Brute Forcing Critical 9.8
• CVE-2026-23492 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848 High 8.8
• CVE-2023-47637 SQL Injection in Admin Grid Filter API in Pimcore High 8.8

All Pimcore Pimcore vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rcg9-hrhx-6q69.