Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-37280

CVE-2023-37280: Pimcore admin UI vulnerable to Cross-site Scripting in 2 factor authentication setup page

6.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-37280
GHSA ID
GHSA-hqv9-6jqw-9g8m
EPSS Score
0.01577%
CWE
CWE-79
Published
7/12/2023
Updated
11/7/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
pimcore/admin-ui-classic-bundlecomposer< 1.0.31.0.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper output encoding in the Twig template. The key evidence is the patch removing the |raw filter from {{ error|trans([],'admin')|raw }}. In Twig, |raw prevents automatic HTML escaping, making this a classic XSS pattern when applied to untrusted input. The error parameter is directly reflected from the URL into the page without sanitization, enabling script injection. The fix confirms this by removing the dangerous raw filter, leaving {{ error|trans([],'admin') }} which enables Twig's default HTML escaping.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Summ*ry Un*ut**nti**t** *TML Inj**tion / XSS Possi*l*. *on*itions: ****tor *ut**nti**tion must not s*t ***or* Vuln*r**l* *n*point: /**min/lo*in/***-s*tup Vuln*r**l* P*r*m: *rror= *ow it works, So **si**lly *ny **min, w*o **s not s*tup * ***t

Reasoning

T** vuln*r**ility st*ms *rom improp*r output *n*o*in* in t** Twi* t*mpl*t*. T** k*y *vi**n** is t** p*t** r*movin* t** `|r*w` *ilt*r *rom `{{ *rror|tr*ns([],'**min')|r*w }}`. In Twi*, `|r*w` pr*v*nts *utom*ti* *TML *s**pin*, m*kin* t*is * *l*ssi* XSS