Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-2343

CVE-2023-2343: Cross-site Scripting (XSS) in DataObject Classification Store

5.4

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-2343
GHSA ID
GHSA-9q7q-r54q-3f3g
EPSS Score
0.00013%
CWE
CWE-79
Published
4/27/2023
Updated
11/11/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
pimcore/pimcorecomposer< 10.5.2110.5.21

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing input sanitization in both backend PHP controllers and frontend JavaScript handlers. The patch adds SecurityHelper::getStringWithoutControlChars in PHP and equivalent JS sanitization, indicating the original functions lacked proper neutralization of special characters in user-controlled 'name' parameters. The affected functions directly process() user input that gets reflected in admin UI elements like confirmation dialogs and store/group names, creating XSS vectors when malicious payloads are injected.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T*is vuln*r**ility **s t** pot*nti*l to st**l * us*r's *ooki* *n* **in un*ut*oriz** ****ss to t**t us*r's ***ount t*rou** t** stol*n *ooki* or r**ir**t us*rs to ot**r m*li*ious sit*s. ### P*t***s Up**t* to v*rsion **.*.** or *pply t*is p*

Reasoning

T** vuln*r**ility st*ms *rom missin* input s*nitiz*tion in *ot* ***k*n* `P*P` *ontroll*rs *n* *ront*n* `J*v*S*ript` **n*l*rs. T** p*t** ***s `S**urity**lp*r::**tStrin*Wit*out*ontrol***rs` in `P*P` *n* *quiv*l*nt `JS` s*nitiz*tion, in*i**tin* t** ori*