UpHeron
All vulnerabilities

Servers and applications

CVE-2023-2332

Cross-site Scripting (XSS) in Conditions tab of Pricing Rules

Severity
Medium 4.8
Published
27 Apr 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
10.5.21
Also known as
GHSA-r7mm-jx6h-hv7m
Sources
NVD, Project advisories (GitHub)

Description

A stored Cross-site Scripting (XSS) vulnerability exists in the Conditions tab of Pricing Rules in pimcore/pimcore versions 10.5.19. The vulnerability is present in the From and To fields of the Date Range section, allowing an attacker to inject malicious scripts. This can lead to the execution of arbitrary JavaScript code in the context of the user's browser, potentially stealing cookies or…

Affected software

SoftwareAffected versions
PimcoreServers and applications · cpe:a:pimcore:pimcore
  • Version 10.5.19
PimcoreServers and applications · github:pimcore/pimcore
  • Every version before 10.5.21

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-2332
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-2332
  • GitHub Advisory Database https://github.com/advisories/GHSA-r7mm-jx6h-hv7m
  • github.com https://github.com/pimcore/pimcore/security/advisories/GHSA-r7mm-jx6h-hv7m