CVE-2023-37280 Pimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup page
An attacker can execute arbitrary scripts in the Pimcore admin UI if two-factor authentication is not yet configured, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-37280?
CVE-2023-37280 is a medium-severity cross-site scripting vulnerability in pimcore admin-ui-classic-bundle, published on 11 Jul 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Pimcore Admin Classic Bundle provides a Backend UI for Pimcore based on the ExtJS framework. An admin who has not setup two factor authentication before is vulnerable for this attack, without need for any form of privilege, causing the application to execute arbitrary scripts/HTML content. This vulnerability has been patched in version 1.0.3.
Weakness: CWE-79
Which versions are affected by CVE-2023-37280?
2 open source packages ship an affected version, including pimcore/admin-ui-classic-bundle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pimcore/admin-ui-classic-bundle Packagist | All versions | 1.0.3 |
pimcore/admin-ui-classic-bundle Packagist | All versions | 1.0.3 |
Products include Pimcore Admin Classic Bundle.
How do I fix CVE-2023-37280?
Upgrade pimcore/admin-ui-classic-bundle to 1.0.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-37280 being exploited?
There is no known exploitation of CVE-2023-37280 in the wild and no public exploit code.
Other vulnerabilities in pimcore admin-ui-classic-bundle
- CVE-2024-23646 Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip
- CVE-2024-23648 Pimcore Admin Classic Bundle host header injection in the password reset
- CVE-2023-49075 Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
- CVE-2024-25625 Pimcore Host Header Injection in user invitation link
- CVE-2025-24980 Pimcore Admin Classic Bundle allows user enumeration
Sources
Also known as GHSA-hqv9-6jqw-9g8m.