CVE-2023-28850 Pimcore Perspective Editor vulnerable to Cross-site Scripting in perspective name
Attackers can inject scripts into perspective names to steal cookies and hijack user accounts in Pimcore Perspective Editor.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-28850?
CVE-2023-28850 is a medium-severity cross-site scripting vulnerability in pimcore perspective-editor, published on 3 Apr 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Version 1.5.1 has a patch. As a workaround, one may apply the patch manually.
Weakness: CWE-79
Which versions are affected by CVE-2023-28850?
2 open source packages ship an affected version, including pimcore/perspective-editor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pimcore/perspective-editor Packagist | All versions | 1.5.1 |
pimcore/perspective-editor Packagist | All versions | 1.5.1 |
Products include Pimcore Perspective Editor.
How do I fix CVE-2023-28850?
Upgrade pimcore/perspective-editor to 1.5.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-28850 being exploited?
There is no known exploitation of CVE-2023-28850 in the wild and no public exploit code.
Sources
Also known as GHSA-fq8q-55v3-2986.