Skip to content

Improper Neutralization of Text-Values in Object Version Preview

Moderate
brusch published GHSA-w6j8-jc36-x5q9 Sep 1, 2021

Package

composer pimcore/pimcore (Composer)

Affected versions

< 10.1.1

Patched versions

10.1.2

Description

Text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources.

Patch: #10170

Severity

Moderate

CVE ID

CVE-2021-39166

Weaknesses

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Learn more on MITRE.