Miggo Logo
Book a Demo
Miggo Vulnerability Database
→
CVE-2023-2328

CVE-2023-2328:
Cross-site Scripting (XSS) in DataObjects QuantityValue Unit Definition

5.2

CVSS Score

Basic Information

CVE ID
CVE-2023-2328
GHSA ID
GHSA-2295-vh28-pphc
EPSS Score
-
CWE
CWE-79
Published
4/27/2023
Updated
11/7/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
pimcore/pimcorecomposer< 10.5.2110.5.21

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing input sanitization in setters that handle user-controlled data. The patches add htmlspecialchars() to these PHP setters and client-side sanitization in JS editors. These functions directly accepted user input without encoding, allowing stored XSS when values were rendered in admin UI elements. The high confidence comes from the direct correlation between the vulnerability description, CWE-79 classification, and the specific sanitization additions in the patch.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T*is vuln*r**ility **s t** pot*nti*l to st**l * us*r's *ooki* *n* **in un*ut*oriz** ****ss to t**t us*r's ***ount t*rou** t** stol*n *ooki* or r**ir**t us*rs to ot**r m*li*ious sit*s. ### P*t***s Up**t* to v*rsion **.*.** or *pply t**s* p

Reasoning

T** vuln*r**ility st*ms *rom missin* input s*nitiz*tion in s*tt*rs t**t **n*l* us*r-*ontroll** **t*. T** p*t***s *** *tmlsp**i*l***rs() to t**s* P*P s*tt*rs *n* *li*nt-si** s*nitiz*tion in JS **itors. T**s* *un*tions *ir**tly ****pt** us*r input wit*