Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-2332

CVE-2023-2332: Cross-site Scripting (XSS) in Conditions tab of Pricing Rules

4

CVSS Score
3.0

Basic Information

CVE ID
CVE-2023-2332
GHSA ID
GHSA-r7mm-jx6h-hv7m
EPSS Score
0.00016%
CWE
CWE-79
Published
4/27/2023
Updated
11/15/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
pimcore/pimcorecomposer< 10.5.2110.5.21

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The XSS vulnerability stemmed from insufficient input sanitization in date field handlers within the Pricing Rules' Conditions tab. The patch added client-side validation() using Ext.String.hasHtmlCharacters in onChange handlers, which indicates the vulnerability existed in the datefield components' input handling. The PHP DateRange changes address null handling but aren't directly XSS-related. The primary vulnerable code was the JavaScript datefield configuration that lacked input sanitization before rendering.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T*is vuln*r**ility **s t** pot*nti*l to st**l * us*r's *ooki* *n* **in un*ut*oriz** ****ss to t**t us*r's ***ount t*rou** t** stol*n *ooki* or r**ir**t us*rs to ot**r m*li*ious sit*s. ### P*t***s Up**t* to v*rsion **.*.** or *pply t*is p

Reasoning

T** XSS vuln*r**ility st*mm** *rom insu**i*i*nt input s*nitiz*tion in **t* *i*l* **n*l*rs wit*in t** Pri*in* Rul*s' *on*itions t**. T** p*t** ***** *li*nt-si** `v*li**tion()` usin* *xt.Strin*.**s*tml***r**t*rs in on***n** **n*l*rs, w*i** in*i**t*s t*