CVE-2023-2332CWE-79

Stored Cross-site Scripting (XSS) in pimcore/pimcore

Medium · published November 15, 2024

CVSS v3.0
4.0
EPSS
0%
Percentile
28.5
In the wild
Unconfirmed
What it is

A stored Cross-site Scripting (XSS) vulnerability exists in the Conditions tab of Pricing Rules in pimcore/pimcore versions 10.5.19. The vulnerability is present in the From and To fields of the Date Range section, allowing an attacker to inject malicious scripts. This can lead to the execution of arbitrary JavaScript code in the context of the user's browser, potentially stealing cookies or redirecting users to malicious sites. The issue is fixed in version 10.5.21.

The record
Technical detail
CVSS v3.0
4.0 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00359 · 28.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-11-15T10:57Z
EPSS history
Timeline
  • 15 NOV 10:57Z
    Stored Cross-site Scripting (XSS) in pimcore/pimcore
    cvelistv5