What is CVE-2021-39166?

CVE-2021-39166 is a high-severity vulnerability in Pimcore, classified under Cross-site Scripting. CVSS score: 8.0/10. Published 2021-09-01.

How severe is CVE-2021-39166?

High severity. CVSS v3 base score is 8.0 out of 10.

XSS in Pimcore

CVE-2021-39166

Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources. This issue is patched in Pimcore version 10.1.2.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.008 (52.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.

Affected products

Pimcore — versions < 10.1.2

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

security-advisories@github.com (x_refsource_CONFIRM, Patch, Third Party Advisory)
security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-39166?: CVE-2021-39166 is a high-severity vulnerability in Pimcore, classified under Cross-site Scripting. CVSS score: 8.0/10. Published 2021-09-01.
How severe is CVE-2021-39166?: High severity. CVSS v3 base score is 8.0 out of 10.