CVE-2023-37280 json
Pimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup page
published 2023-07-11 3 y ago modified 2026-06-17 4 mo ago also GHSA-hqv9-6jqw-9g8m , EUVD-2023-2080
- cvss
- 5.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
Pimcore Admin Classic Bundle provides a Backend UI for Pimcore based on the ExtJS framework. An admin who has not setup two factor authentication before is vulnerable for this attack, without need for any form of privilege, causing the application to execute arbitrary scripts/HTML content. This vulnerability has been patched in version 1.0.3.
Patch / fix
- packagist pimcore/admin-ui-classic-bundle 1.0.3
- pimcore admin_classic_bundle 1.0.3
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.58% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | pimcore/admin-ui-classic-bundle | <1.0.3 |
1.0.3 |
Affected products
- pimcore admin-ui-classic-bundle
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/pimcore/admin-ui-classic-bundle/pull/147
web, patch
-
github.com
/pimcore/admin-ui-classic-bundle/commit/5fcd19bdc89a3fe4cb8ad8c356590e1e4740c743
web, patch
-
github.com
/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-hqv9-6jqw-9g8m
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-37280
advisory
-
github.com
/pimcore/admin-ui-classic-bundle
package
-
huntr.dev
/bounties/1fa1cc3b-75ff-4d34-99ae-4a705eb623e7
web
Sources
- CVE List CVE-2023-37280
- GitHub Advisory GHSA-hqv9-6jqw-9g8m
- NVD CVE-2023-37280
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.