CVE-2023-3821
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository pimcore/pimcore prior to version 10.6.4, allowing for the storage of malicious code.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious scripts, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to upgrade to version 10.6.4 or later to mitigate this vulnerability.
Other vulnerabilities in pimcore/pimcore
See all- CVE-2023-4453Medium
A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository pimcore/pimcore prior to version 10.6.8.
- CVE-2023-3822Medium
A Cross-site Scripting (XSS) vulnerability - Reflected exists in the GitHub repository pimcore/pimcore prior to version 10.6.4.
- CVE-2023-3820High
There is an SQL Injection vulnerability in the GitHub repository pimcore/pimcore prior to version 10.6.4.
- CVE-2023-3673High
There is a SQL Injection vulnerability in the GitHub repository pimcore/pimcore prior to version 10.5.24.
Original NVD description (English source)
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.6.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS