Multiple vulnerabilities in Pimcore



Published: 2023-03-17
Risk Low
Patch available YES
Number of vulnerabilities 5
CVE-ID CVE-2023-1286
CVE-2023-1312
CVE-2023-1429
CVE-2023-28106
CVE-2023-28108
CWE-ID CWE-79
CWE-89
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Public exploit code for vulnerability #2 is available.
Public exploit code for vulnerability #3 is available.
Public exploit code for vulnerability #4 is available.
Vulnerable software
Subscribe 		Pimcore
Web applications / CMS

Vendor Pimcore

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) Stored cross-site scripting

EUVDB-ID: #VU73787

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2023-1286

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in Print Documents. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Pimcore: 10.5.0 - 10.5.18

CPE2.3 External links

http://huntr.dev/bounties/31d97442-3f87-439f-83f0-1c7862ef0c7c
http://github.com/pimcore/pimcore/commit/82cca7f4a7560b160336cce2610481098ca52c18

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Cross-site scripting

EUVDB-ID: #VU73789

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2023-1312

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in Application Logger module. A remote user can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Pimcore: 10.5.0 - 10.5.18

CPE2.3 External links

http://huntr.dev/bounties/2a64a32d-b1cc-4def-91da-18040d59f356
http://github.com/pimcore/pimcore/commit/d35d0712858f24d0ec96ddfd4cbe82ff4b5a5fbb

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Cross-site scripting

EUVDB-ID: #VU73790

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2023-1429

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in Document Types module in Settings. A remote user can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Pimcore: 10.5.0 - 10.5.18

CPE2.3 External links

http://huntr.dev/bounties/e0829fea-e458-47b8-84a3-a74476d9638f
http://github.com/pimcore/pimcore/commit/7588c336edb24050656111b89d69e69cc9feb5f5

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

4) Cross-site scripting

EUVDB-ID: #VU73791

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2023-28106

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in UrlSlug Data type. A remote user can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Pimcore: 10.5.0 - 10.5.18

CPE2.3 External links

http://github.com/pimcore/pimcore/commit/c59d0bf1d03a5037b586fe06230694fa3818dbf2
http://github.com/pimcore/pimcore/pull/14669.patch
http://huntr.dev/bounties/fa77d780-9b23-404b-8c44-12108881d11a
http://github.com/pimcore/pimcore/security/advisories/GHSA-x5j3-mq9g-8jc8

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

5) SQL injection

EUVDB-ID: #VU73792

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2023-28108

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data. A local administrator can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Pimcore: 10.5.0 - 10.5.18

CPE2.3 External links

http://github.com/pimcore/pimcore/security/advisories/GHSA-xc9p-r5qj-8xm9
http://github.com/pimcore/pimcore/commit/08e7ba56ae983c3c67ec563b6989b16ef8f35275.patch
http://github.com/pimcore/pimcore/pull/14633

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###