{"id":"CVE-2022-0832","published":"2022-03-04T13:40:10Z","modified":"2024-08-02T23:40:04Z","title":"Cross-site Scripting (XSS) - Stored in pimcore/pimcore","vendor":"pimcore","product":"pimcore/pimcore","tier":"core","eol":null,"affectedVersions":[{"vendor":"pimcore","product":"pimcore/pimcore","versions":[">= unspecified, < 10.3.3"]}],"description":{"text":"Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.","provenance":"source","from":"CVE.org"},"summary":{"text":"A stored cross-site scripting flaw exists in the pimcore/pimcore product, in its repository's code prior to version 10.3.3. An attacker who holds a high-privilege account can plant script that executes in other users' browsers when they view the affected content, with the attack requiring local access and the victim to interact with the page.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:22:38Z"},"cvss":{"score":4.6,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.6662,"percentile":0.99287,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://huntr.dev/bounties/be450b60-bc8f-4585-96a5-3c4069f1186a","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/pimcore/pimcore/commit/8ab06bfbb5a05a1b190731d9c7476ec45f5ee878","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Packagist","package":"pimcore/pimcore","vulnerableRanges":["<10.3.3"],"patched":["10.3.3"],"from":["GHSA-6qcc-whgp-pjj2"],"provenance":"source"}],"advisories":[{"id":"GHSA-6qcc-whgp-pjj2","url":"https://github.com/advisories/GHSA-6qcc-whgp-pjj2","severity":"MODERATE","ecosystem":"Packagist","package":"pimcore/pimcore","vulnerableRanges":["<10.3.3"],"patched":["10.3.3"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-1346","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1346","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-03-04","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-0832","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":23.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.86,"detail":"percentile 0.9929"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":3.22,"detail":"base score 4.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2022-0565","published":"2022-02-12","fixed":"10.3.1","kev":false},{"cve":"CVE-2022-0665","published":"2022-02-22","fixed":"10.3.2","kev":false,"link":{"from":"CVE-2022-0665","to":"CVE-2022-0832","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:pimcore/pimcore","fromFixed":"10.3.2","toFixed":"10.3.3","daysApart":10}]}},{"cve":"CVE-2022-0831","published":"2022-03-04","fixed":"10.3.3","kev":false},{"cve":"CVE-2022-0832","published":"2022-03-04","fixed":"10.3.3","kev":false},{"cve":"CVE-2023-2730","published":"2023-05-16","fixed":"10.3.3","kev":false},{"cve":"CVE-2022-1219","published":"2022-04-08","fixed":"10.3.5","kev":false},{"cve":"CVE-2022-1339","published":"2022-04-13","fixed":"10.3.5","kev":false}],"package":"Packagist:pimcore/pimcore"}}