What is GHSA-599v-h3q5-g6r9?

GHSA-599v-h3q5-g6r9 is a security advisory published by GitHub Security Advisories with Medium severity. Pimcore Cross-site Scripting (XSS) vulnerability in DataObject datetime fields

Which CVE IDs does GHSA-599v-h3q5-g6r9 cover?

GHSA-599v-h3q5-g6r9 covers the following CVE IDs: CVE-2023-4453. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-599v-h3q5-g6r9?

GHSA-599v-h3q5-g6r9 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-599v-h3q5-g6r9?

GHSA-599v-h3q5-g6r9 affects 1 product, including: composer/pimcore/pimcore:\u003c 10.6.8.

GHSA-599v-h3q5-g6r9MediumCVSS 5.4

Pimcore Cross-site Scripting (XSS) vulnerability in DataObject datetime fields

Vendor

GitHub Security Advisories

Published

August 21, 2023

Last Modified

November 9, 2023

🔗 CVE IDs covered (1)

CVE-2023-4453 →

📋 Description

Impact

This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

Patches

Update to version 10.6.8 or apply this patch manually https://github.com/pimcore/pimcore/commit/234c0c02ea7502071b00ab673fbe4a6ac253080e.patch

Workarounds

Apply patch https://github.com/pimcore/pimcore/commit/234c0c02ea7502071b00ab673fbe4a6ac253080e.patch manually.

References

https://huntr.dev/bounties/245a8785-0fc0-4561-b181-fa20f869d993/

🎯 Affected products1

composer/pimcore/pimcore:< 10.6.8

🔗 References (5)

https://github.com/pimcore/pimcore/security/advisories/GHSA-599v-h3q5-g6r9
https://nvd.nist.gov/vuln/detail/CVE-2023-4453
https://github.com/pimcore/pimcore/commit/234c0c02ea7502071b00ab673fbe4a6ac253080e
https://huntr.dev/bounties/245a8785-0fc0-4561-b181-fa20f869d993
https://github.com/advisories/GHSA-599v-h3q5-g6r9