Lucene search
Veracode Vulnerability DatabaseVERACODE:40145HistoryApr 18, 2023 - 5:31 a.m.
Cross-Site Scripting (XSS)
2023-04-1805:31:10
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
4
cross-site scripting
sanitization
cookie theft
unauthorized access
0.001 Low
EPSS
Percentile
29.1%
pimcore/perspective-editor is vulnerable to Cross-Site Scripting (XSS). The vulnerability is due to a lack of sanitization when adding a perspective name, which allows an attacker to steal a users cookie and gaining unauthorized access to that user’s account.
| CPE | Name | Operator | Version |
|---|---|---|---|
| pimcore/perspective-editor | le | v1.5.0 | |
| pimcore/perspective-editor | le | v1.5.0 |
References
github.com/pimcore/perspective-editor/commit/16979055c684ff3321cf0945d11a1b0ee1e4b8d2
github.com/pimcore/perspective-editor/commit/16979055c684ff3321cf0945d11a1b0ee1e4b8d2
github.com/pimcore/perspective-editor/security/advisories/GHSA-fq8q-55v3-2986
huntr.dev/bounties/5529f51e-e40f-46f1-887b-c9dbebab4f06/
Related
osv
osv
Pimcore Perspective Editor vulnerable to stored cross-site scripting (XSS) in perspective name
2023-04-03 18:58:01
CVE-2023-28850
2023-04-03 18:15:07
nvd
nvd
CVE-2023-28850
2023-04-03 18:15:07
prion
prion
Code injection
2023-04-03 18:15:00
github
github
cve
cve
CVE-2023-28850
2023-04-03 18:15:07
cvelist
cvelist