CVE-2023-42817 Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translations
Attackers can inject malicious scripts via translation strings in the Pimcore admin UI, potentially executing code or bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-42817?
CVE-2023-42817 is a medium-severity cross-site scripting vulnerability in pimcore admin-ui-classic-bundle, published on 25 Sep 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user. The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box. This issue has been patched in commit `abd77392` which is included in release 1.1.2. Users are advised to update to version 1.1.2 or apply the patch manually.
Weakness: CWE-79
Which versions are affected by CVE-2023-42817?
2 open source packages ship an affected version, including pimcore/admin-ui-classic-bundle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pimcore/admin-ui-classic-bundle Packagist | All versions | 1.1.2 |
pimcore/admin-ui-classic-bundle Packagist | All versions | 1.1.2 |
Products include Pimcore Admin Classic Bundle.
How do I fix CVE-2023-42817?
Upgrade pimcore/admin-ui-classic-bundle to 1.1.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-42817 being exploited?
There is no known exploitation of CVE-2023-42817 in the wild and no public exploit code.
Other vulnerabilities in pimcore admin-ui-classic-bundle
- CVE-2024-23646 Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip
- CVE-2024-23648 Pimcore Admin Classic Bundle host header injection in the password reset
- CVE-2023-49075 Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
- CVE-2024-25625 Pimcore Host Header Injection in user invitation link
- CVE-2025-24980 Pimcore Admin Classic Bundle allows user enumeration
Sources
Also known as GHSA-m988-7375-7g2c.