Medium severity · published Jul 11, 2023
CVE-2023-37280
Pimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup page
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
Pimcore Admin Classic Bundle provides a Backend UI for Pimcore based on the ExtJS framework. An admin who has not setup two factor authentication before is vulnerable for this attack, without need for any form of privilege, causing the application to execute arbitrary scripts/HTML content. This vulnerability has been patched in version 1.0.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
admin-ui-classic-bundle · pimcore
< 1.0.3 · source: vendor
AC
Admin Classic Bundle · Pimcore
before 1.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-37280
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-37280
Patch
https://github.com/pimcore/admin-ui-classic-bundle/commit/5fcd19bdc89a3fe4cb8ad8c356590e1e4740c743
Patch
https://github.com/pimcore/admin-ui-classic-bundle/pull/147
Vendor Advisory
https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-hqv9-6jqw-9g8m
More from admin-ui-classic-bundle
9.3
CVE-2024-25625
Pimcore Host Header Injection in user invitation link
9.1
CVE-2024-24822
Pimcore Admin Classic Bundle permissions are not getting checked when working with tags
8.8
CVE-2024-23646
Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip
8.8
CVE-2024-23648
Pimcore Admin Classic Bundle host header injection in the password reset
7.2
CVE-2023-49075
Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls