QwikSec

Security Database

CVE

CWE

Training

CVE-2023-28106

Published: Mar 16, 2023

Modified: Feb 25, 2025

PUBLISHED

CVSS v3.1

6.1

MEDIUM

Description

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually.

Vendor	Product	Versions
pimcore	pimcore	affected `< 10.5.19`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

References

https://github.com/pimcore/pimcore/security/advisories/GHSA-x5j3-mq9g-8jc8

x_refsource_CONFIRM

https://github.com/pimcore/pimcore/pull/14669.patch

x_refsource_MISC

https://github.com/pimcore/pimcore/commit/c59d0bf1d03a5037b586fe06230694fa3818dbf2

x_refsource_MISC

https://huntr.dev/bounties/fa77d780-9b23-404b-8c44-12108881d11a

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.