MEDIUM6.1

GHSA-rcg9-hrhx-6q69

Pimcore has Cross-site Scripting vulnerability in DataObject tooltip field

Quick fix

GHSA-rcg9-hrhx-6q69 — pimcore/pimcore: upgrade to the fixed version with the command below.

composer require pimcore/pimcore:^10.5.19

Details

### Impact Unsecured tooltip field in DataObject class definition.

This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

### Patches Update to version 10.5.19 or apply this patch manually https://github.com/pimcore/pimcore/pull/14574.patch

### Workarounds Apply https://github.com/pimcore/pimcore/pull/14574.patch manually.

### References

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/pimcore/pimcore

Introduced in: 0Fixed in: 10.5.19

Fixcomposer require pimcore/pimcore:^10.5.19

References

https://github.com/pimcore/pimcore/security/advisories/GHSA-rcg9-hrhx-6q69[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2023-28429[ADVISORY]
https://github.com/pimcore/pimcore/pull/14574[WEB]
https://github.com/pimcore/pimcore/pull/14574.patch[WEB]
https://github.com/pimcore/pimcore[PACKAGE]