CVE-2023-28106
Pimcore vulnerable to Cross-site Scripting in UrlSlug Data type
Summary
Pimcore vulnerable to Cross-site Scripting in UrlSlug Data type
Original description
The description as published by the source.
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Packagist
pimcore/pimcore
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.19"}]}]
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com
- patch github.com
- web huntr.dev