Medium severity · published Nov 15, 2024
CVE-2023-2332
Stored Cross-site Scripting (XSS) in pimcore/pimcore
4.8
CVSS
0.4%
EPSS
No
On KEV
Description
A stored Cross-site Scripting (XSS) vulnerability exists in the Conditions tab of Pricing Rules in pimcore/pimcore versions 10.5.19. The vulnerability is present in the From and To fields of the Date Range section, allowing an attacker to inject malicious scripts. This can lead to the execution of arbitrary JavaScript code in the context of the user's browser, potentially stealing cookies or redirecting users to malicious sites. The issue is fixed in version 10.5.21.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
pimcore/pimcore · pimcore
before 10.5.21 · source: vendor
PI
Pimcore · Pimcore
10.5.19 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-2332
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-2332
Patch
https://github.com/pimcore/pimcore/commit/a4491551967d879141a3fdf0986a9dd3d891abfe
Exploit
https://huntr.com/bounties/e436ed71-6741-4b30-89db-f7f3de4aca2c
More from pimcore/pimcore
8.8
CVE-2023-2984
Path Traversal: '\..\filename' in pimcore/pimcore
8.8
CVE-2023-2983
Privilege Defined With Unsafe Actions in pimcore/pimcore
8.8
CVE-2023-2338
SQL Injection in pimcore/pimcore
8.8
CVE-2023-1578
SQL Injection in pimcore/pimcore
7.2
CVE-2023-3820
SQL Injection in pimcore/pimcore