Pimcore Cross-site Scripting

If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is able to view. Modify any information that the user is able to modify. Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user. (2022-09-21, CVE-2022-3255)

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.6. (2022-09-15, CVE-2022-3211)

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.4. (2022-08-23, CVE-2022-2796)

Stored XSS in Tooltip in GitHub repository pimcore/pimcore prior to 10.4. (2022-04-14, CVE-2022-1351)

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. (2022-03-16, CVE-2022-0705)

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. (2022-03-16, CVE-2022-0704)

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. (2022-03-16, CVE-2022-0911)

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. (2022-03-15, CVE-2022-0893)

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. (2022-03-15, CVE-2022-0894)

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3. (2022-03-04, CVE-2022-0831)

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3. (2022-03-04, CVE-2022-0832)

Cross-site Scripting (XSS) - Reflected in Packagist pimcore/pimcore prior to 10.3.1. (2022-02-08, CVE-2022-0510)

Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1. (2022-02-08, CVE-2022-0509)

Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2. (2022-01-27, CVE-2022-0348)

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.10. (2022-01-26, CVE-2022-0251)

Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9. (2022-01-20, CVE-2022-0285)

Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.7. (2022-01-18, CVE-2022-0262)

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.7. (2022-01-18, CVE-2022-0260)

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (2022-01-17, CVE-2022-0256)

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (2022-01-17, CVE-2022-0257)

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (2021-12-21, CVE-2021-4139)

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (2021-12-10, CVE-2021-4084)

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (2021-12-10, CVE-2021-4081)

Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a value of custom metadata on assets. There is a patch for this issue in Pimcore version 10.1.2. As a workaround, users may apply the patch manually. (2021-09-01, CVE-2021-39170)

Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources. This issue is patched in Pimcore version 10.1.2. (2021-09-01, CVE-2021-39166)

bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header. (2019-11-15, CVE-2019-18982)

Pimcore 6.2.3 has XSS in the translations grid because bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js mishandles certain HTML elements. (2019-10-31, CVE-2019-18656)

Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions. (2018-08-24, CVE-2018-14059)

Cross site scripting is an attack where a web page executes code that is injected by an adversary. It usually appears, when users input is presented. This attack can be used to impersonate a user, take over control of the session, or even steal API keys.

The attack can be executed e.g. when you application injects the request parameter directly into the HTML code of the page returned to the user:

https://server.com/confirmation?message=Transaction+Complete

what results in:

<span>Confirmation: Transaction Complete</span>

In that case the message can be modified to become a valid Javascript code, e.g.:

https://server.com/confirmation?message=<script>dangerous javascript code here</script>

and it will be executed locally by the user's browser with full access to the user's personal application/browser data:

<span>Confirmation: <script>dangerous javascript code here</script></span>