Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-2361

CVE-2023-2361: Cross-site Scripting (XSS) in pimcore

5.4

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-2361
GHSA ID
GHSA-9xg6-75mh-7x3f
EPSS Score
0.00206%
CWE
CWE-79
Published
5/1/2023
Updated
11/7/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
pimcore/pimcorecomposer< 10.5.2110.5.21

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from multiple functions handling user-controlled data without adequate sanitization before HTML output. The patch adds SecurityHelper::sanitizeHtmlAttributes() to these methods and removes dangerous 'on*' attributes from the allow list. The frontend() method was particularly critical as it directly constructed HTML attributes from unsanitized inputs. The getter methods (getParameters, getAnchor, etc.) returned raw data that flowed into HTML contexts. The setDataFromResource method's lack of sanitization allowed stored XSS payloads. The high confidence comes from the explicit security fixes applied to these specific functions in the commit.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t *n *tt**k*r **n us* XSS to s*n* * m*li*ious s*ript to *ny us*r. ### P*t***s Up**t* to v*rsion **.*.** or *pply t*is p*t** m*nu*lly *ttps://*it*u*.*om/pim*or*/pim*or*/*ommit/****************************************.p*t** ### Work*roun*s *

Reasoning

T** vuln*r**ility st*mm** *rom multipl* *un*tions **n*lin* us*r-*ontroll** **t* wit*out ***qu*t* s*nitiz*tion ***or* *TML output. T** p*t** ***s `S**urity**lp*r::s*nitiz**tml*ttri*ut*s()` to t**s* m*t*o*s *n* r*mov*s **n**rous 'on*' *ttri*ut*s *rom t