CVE-2023-2332 json
Stored Cross-site Scripting (XSS) in pimcore/pimcore
published 2023-04-27 3 y ago modified 2026-06-17 4 mo ago also GHSA-r7mm-jx6h-hv7m , EUVD-2023-1389
- cvss
- 4.0
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 31%
- public exploits
- 0
- none known
Summary
A stored Cross-site Scripting (XSS) vulnerability exists in the Conditions tab of Pricing Rules in pimcore/pimcore versions 10.5.19. The vulnerability is present in the From and To fields of the Date Range section, allowing an attacker to inject malicious scripts. This can lead to the execution of arbitrary JavaScript code in the context of the user's browser, potentially stealing cookies or redirecting users to malicious sites. The issue is fixed in version 10.5.21.
Patch / fix
- packagist pimcore/pimcore 10.5.21
- pimcore pimcore/pimcore 10.5.21
- pimcore pimcore 10.5.21
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 23 mo ago
Exploit prediction
0.37% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/e436ed71-6741-4b30-89db-f7f3de4aca2c referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 4.0 | CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.0 | 4.0 | CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | pimcore/pimcore | <10.5.21 |
10.5.21 |
Affected products
- pimcore pimcore/pimcore
- pimcore pimcore
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/pimcore/pimcore/commit/a4491551967d879141a3fdf0986a9dd3d891abfe
web, patch
-
huntr.com
/bounties/e436ed71-6741-4b30-89db-f7f3de4aca2c
web, exploit, third-party-advisory
-
github.com
/pimcore/pimcore/security/advisories/GHSA-r7mm-jx6h-hv7m
web
-
nvd.nist.gov
/vuln/detail/CVE-2023-2332
advisory
-
github.com
/pimcore/pimcore
package
Sources
- CVE List CVE-2023-2332
- GitHub Advisory GHSA-r7mm-jx6h-hv7m
- NVD CVE-2023-2332
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.