UpHeron
All vulnerabilities

Servers and applications

CVE-2023-28429

Cross-site Scripting (XSS) in DataObject tooltip field

Severity
Medium 6.1
Published
20 Mar 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
10.5.19
Also known as
GHSA-rcg9-hrhx-6q69
Sources
NVD, Project advisories (GitHub)

Description

Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 10.5.19 or, as a…

Affected software

SoftwareAffected versions
PimcoreServers and applications · cpe:a:pimcore:pimcore
  • Every version before 10.5.19
PimcoreServers and applications · github:pimcore/pimcore
  • Every version before 10.5.19

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-28429
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-28429
  • GitHub Advisory Database https://github.com/advisories/GHSA-rcg9-hrhx-6q69
  • github.com https://github.com/pimcore/pimcore/security/advisories/GHSA-rcg9-hrhx-6q69