Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-1702

CVE-2023-1702: Pimcore Cross-site Scripting in Predefined Asset Metadata module in Settings

5.4

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-1702
GHSA ID
GHSA-6qjm-39vh-729w
EPSS Score
0.00018%
CWE
CWE-79
Published
3/31/2023
Updated
4/1/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
pimcore/pimcorecomposer< 10.5.2010.5.20

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The patch explicitly adds Ext.util.Format.htmlEncode() to sanitize data.data.name in both files. The vulnerability stems from directly using user-controlled input (metadata/property names) in confirmation dialogs without proper escaping, which is a textbook XSS vector. The commit's security focus and CWE-79 classification confirm this assessment.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T*is vuln*r**ility **s t** pot*nti*l to st**l * us*r's *ooki* *n* **in un*ut*oriz** ****ss to t**t us*r's ***ount t*rou** t** stol*n *ooki* or r**ir**t us*rs to ot**r m*li*ious sit*s. ### P*t***s Up**t* to v*rsion **.*.** or *pply t*is p*

Reasoning

T** p*t** *xpli*itly ***s *xt.util.*orm*t.*tml*n*o**() to s*nitiz* `**t*.**t*.n*m*` in *ot* *il*s. T** vuln*r**ility st*ms *rom *ir**tly usin* us*r-*ontroll** input (m*t***t*/prop*rty n*m*s) in *on*irm*tion *i*lo*s wit*out prop*r *s**pin*, w*i** is *