Skip to content
Fencer Intel
medium —

GHSA-76r7-h46w-463r json

Cross Site Scripting (XSS) in Model\DataObject\Data\UrlSlug

published 3y ago modified last yr.

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact An attacker can use XSS to send a malicious script to an unsuspecting user.

### Patches Update to version 10.5.17 or apply this patch manually https://github.com/pimcore/pimcore/pull/14301.patch

### Workarounds Apply https://github.com/pimcore/pimcore/pull/14301.patch manually.

### References https://huntr.dev/bounties/75bc7d07-46a7-4ed9-a405-af4fc47fb422/

Patch / fix

  • packagist pimcore/pimcore 10.5.17

Is GHSA-76r7-h46w-463r in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
packagist pimcore/pimcore
<10.5.17
10.5.17

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.