Lucene search

@huntrdevCVE-2023-3822

HistoryJul 21, 2023 - 3:15 p.m.

CVE-2023-3822

2023-07-2115:15:10

CWE-79

@huntrdev

web.nvd.nist.gov

cve

2023

3822

cross-site scripting

xss

github

pimcore

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

33.2%

JSON

Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.4.

Affected configurations

Nvd

Node

pimcorepimcoreRange<10.6.4

VendorProductVersionCPE
pimcorepimcore*cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pimcore	pimcore	*	cpe:2.3:a:pimcore:pimcore::::::::

CNA Affected

[
  {
    "vendor": "pimcore",
    "product": "pimcore/pimcore",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "10.6.4",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/pimcore/pimcore/commit/d75888a9b14baaad591548463cca09dfd1395236

huntr.dev/bounties/2a3a13fe-2a9a-4d1a-8814-fd8ed1e3b1d5

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

33.2%

JSON

Related for CVE-2023-3822