What is CVE-2023-2332?

CVE-2023-2332 is a medium-severity vulnerability in Pimcore, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2024-11-15.

How severe is CVE-2023-2332?

Medium severity. CVSS v3 base score is 4.8 out of 10.

XSS in Pimcore

CVE-2023-2332

A stored Cross-site Scripting (XSS) vulnerability exists in the Conditions tab of Pricing Rules in pimcore/pimcore versions 10.5.19. The vulnerability is present in the From and To fields of the Date Range section, allowing an attacker to inject malicious scripts. This can lead to the execution of arbitrary JavaScript code in the context of the user's browser, potentially stealing cookies or redirecting users to malicious sites. The issue is fixed in version 10.5.21.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.004 (28.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N.

Affected products

Pimcore — versions 10.5.19
Pimcore Pimcore/pimcore — versions unspecified

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

security@huntr.dev (Exploit, Third Party Advisory)
security@huntr.dev (Patch)

Frequently asked questions

What is CVE-2023-2332?: CVE-2023-2332 is a medium-severity vulnerability in Pimcore, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2024-11-15.
How severe is CVE-2023-2332?: Medium severity. CVSS v3 base score is 4.8 out of 10.