MediumGHSA-m4x3-xmjv-r778CVE-2019-18982

Pimcore Cross-site Scripting (XSS) vulnerability

Published 24 May 2022 · Updated 24 Apr 2024

Affected package

Affected: <6.3.0
Fixed in: 6.3.0

Update to the fixed version for your release line, for example:composer require pimcore/pimcore:^6.3.0

Details

bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header.

Is GHSA-m4x3-xmjv-r778 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected pimcore/pimcore, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisorynvd.nist.gov/vuln/detail/CVE-2019-18982
Linkgithub.com/pimcore/pimcore/commit/e0b48faf7d29ce43a98825a0b230e88350ebcf78
Packagegithub.com/pimcore/pimcore
Linkgithub.com/pimcore/pimcore/compare/v6.2.3...v6.3.0

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.