CVE-2021-39166
Improper Neutralization of Text-Values in Object Version Preview
Severity Score
5.4
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources. This issue is patched in Pimcore version 10.1.2.
Pimcore es una plataforma de administración de datos y experiencias de código abierto. En versiones anteriores a 10.1.2, los valores de texto no se escapaban apropiadamente versiones anteriores a imprimirse en la visualización previa de la versión. Esto permitía el uso de un ataque de tipo XSS por parte de usuarios autenticados con acceso a los recursos. Este problema se ha parcheado en Pimcore versión 10.1.2
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-08-16 CVE Reserved
- 2021-09-01 CVE Published
- 2023-03-25 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (2)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/pimcore/pimcore/pull/10170 | 2021-09-09 | |
| https://github.com/pimcore/pimcore/security/advisories/GHSA-w6j8-jc36-x5q9 | 2021-09-09 |
| URL | Date | SRC |
|---|