pimcore/perspective-editor · Security
Pimcore Perspective Editor vulnerable to stored cross-site scripting (XSS) in perspective name
- GHSA ID
- GHSA-fq8q-55v3-2986
- CVE ID
- CVE-2023-28850
- Severity
- medium
- Published
- Updated
- CVSS
- 6.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS v3
- 6.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.
Patches
Update to version 1.5.1.
Workarounds
Apply the patch https://github.com/pimcore/perspective-editor/pull/121.patch manually.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- https://github.com/pimcore/perspective-editor/security/advisories/GHSA-fq8q-55v3-2986 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2023-28850 ↗
- https://github.com/pimcore/perspective-editor/pull/121.patch ↗
- https://huntr.dev/bounties/5529f51e-e40f-46f1-887b-c9dbebab4f06/ ↗
- https://github.com/advisories/GHSA-fq8q-55v3-2986 ↗