GHSA-76r7-h46w-463r Cross Site Scripting (XSS) in Model\DataObject\Data\UrlSlug
An attacker can inject malicious scripts via XSS in Pimcore, potentially compromising user sessions or data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-76r7-h46w-463r?
GHSA-76r7-h46w-463r is a cross-site scripting vulnerability in pimcore/pimcore, published on 15 Feb 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Impact
An attacker can use XSS to send a malicious script to an unsuspecting user.
Patches
Update to version 10.5.17 or apply this patch manually https://github.com/pimcore/pimcore/pull/14301.patch
Workarounds
Apply https://github.com/pimcore/pimcore/pull/14301.patch manually.
References
https://huntr.dev/bounties/75bc7d07-46a7-4ed9-a405-af4fc47fb422/
Which versions are affected by GHSA-76r7-h46w-463r?
2 open source packages ship an affected version, including pimcore/pimcore.
| Package | Affected | Fixed in |
|---|---|---|
pimcore/pimcore Packagist | All versions | 10.5.17 |
pimcore/pimcore Packagist | All versions | 10.5.17 |
How do I fix GHSA-76r7-h46w-463r?
Upgrade pimcore/pimcore to 10.5.17 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-76r7-h46w-463r being exploited?
There is no known exploitation of GHSA-76r7-h46w-463r in the wild and no public exploit code.