CVE-2023-2332 Vulnerability Details

  /     /     /  

CVE-2023-2332 Metadata Quick Info

CVE Published: 15/11/2024 | CVE Updated: 15/11/2024 | CVE Year: 2023
Source: @huntr_ai | Vendor: pimcore | Product: pimcore/pimcore
Status : PUBLISHED

---

CVE-2023-2332 Description

A stored Cross-site Scripting (XSS) vulnerability exists in the Conditions tab of Pricing Rules in pimcore/pimcore versions 10.5.19. The vulnerability is present in the From and To fields of the Date Range section, allowing an attacker to inject malicious scripts. This can lead to the execution of arbitrary JavaScript code in the context of the user\'s browser, potentially stealing cookies or redirecting users to malicious sites. The issue is fixed in version 10.5.21.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-79
CWE Name: CWE-79 Improper Neutralization of Input During Web Page Generation ( Cross-site Scripting )
Source: pimcore

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).