Description
Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user. The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box. This issue has been patched in commit `abd77392` which is included in release 1.1.2. Users are advised to update to version 1.1.2 or apply the patch manually.
Published: 2023-09-25
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-m988-7375-7g2c pimcore/admin-ui-classic-bundle Cross-site Scripting vulnerability in Translations
History

Tue, 24 Sep 2024 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Pimcore Admin Classic Bundle
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2024-09-24T14:43:34.632Z

Reserved: 2023-09-14T16:13:33.309Z

Link: CVE-2023-42817

cve-icon Vulnrichment

Updated: 2024-08-02T19:30:24.922Z

cve-icon NVD

Status : Modified

Published: 2023-09-25T19:15:10.493

Modified: 2024-11-21T08:23:16.510

Link: CVE-2023-42817

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses