Skip to content

Improper Neutralization of Text-Values in Object Version Preview

Moderate
brusch published GHSA-w6j8-jc36-x5q9 Sep 1, 2021

Package

composer pimcore/pimcore (Composer)

Affected versions

< 10.1.1

Patched versions

10.1.2

Description

Text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources.

Patch: #10170

Severity

Moderate

CVE ID

CVE-2021-39166

Weaknesses