pimcore · pimcore/pimcore
A stored cross-site scripting flaw exists in the pimcore/pimcore product, in its repository's code prior to version 10.3.3. An attacker who holds a high-privilege account can plant script that executes in other users' browsers when they view the affected content, with the attack requiring local access and the victim to interact with the page.
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.
Disclosed on 4 Mar 2022. No public exploit code or confirmed exploitation is recorded.
7 fixes in pimcore/pimcore over 15 months. The latest fix listed for pimcore/pimcore is 10.3.5.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: pimcore/pimcore.
Upgrade to 10.5.19 or later
Fixes this CVE and 3 other known vulnerabilities in this package (CVE-2019-10867, CVE-2022-1429, +1).
Set the version to 10.5.19 or later in your composer.json.
First fixed in 10.3.3 for CVE-2022-0832.
| If you run | Upgrade to |
|---|---|
| All versions before 10.3.3 | 10.5.19first fix for this CVE: 10.3.3 |
“Up to” means the second version is the fix and is not affected.