Vulnerability · Published Sep 25, 2023 · Assigned by GitHub_M
CVE-2023-42817Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translations
Medium 5.4
In plain English
A medium-severity cross-site scripting in admin-ui-classic-bundle from pimcore. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user. The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box. This issue has been patched in commit `abd77392` which is included in release 1.1.2. Users are advised to update to version 1.1.2 or apply the patch manually.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | pimcore/admin-ui-classic-bundle | 1.1.2 | GHSA-m988-7375-7g2c |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| pimcore | admin-ui-classic-bundle | < 1.1.2 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N