HIGH
Improper Neutralization of Text-Values in Object Version Preview
Published Sep 1, 2021
8.0
HIGHCVSS 3.1
EPSS 0.78%
Description
Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources. This issue is patched in Pimcore version 10.1.2.
Affected products
-
Affected
- < 10.1.2
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (5)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-2123 Advisory
- https://github.com/advisories/GHSA-w6j8-jc36-x5q9 Advisory
- https://github.com/pimcore/pimcore/pull/10170 x_refsource_MISCPatchThird Party Advisory
- https://github.com/pimcore/pimcore/security/advisories/GHSA-w6j8-jc36-x5q9 x_refsource_CONFIRMPatchThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-39166
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-2123 | Advisory | |
| https://github.com/advisories/GHSA-w6j8-jc36-x5q9 | Advisory | |
| https://github.com/pimcore/pimcore/pull/10170 | x_refsource_MISCPatchThird Party Advisory | |
| https://github.com/pimcore/pimcore/security/advisories/GHSA-w6j8-jc36-x5q9 | x_refsource_CONFIRMPatchThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2021-39166 |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published Sep 1, 2021
Updated Aug 4, 2024
Reserved Aug 16, 2021
Link CVE-2021-39166
CISA Vulnrichment
No data
Red Hat
No data
GitHub
Link GHSA-W6J8-JC36-X5Q9