Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2022-0257: pimcore pages may execute malicious scripts
CVE-2022-0257 · published 4 years ago
Summary
The pimcore web platform can allow a user to store code that runs in other visitors' browsers. This could let an attacker steal information or take actions as the user. Apply the latest pimcore update or ensure all input is properly cleaned before displaying it.
What to do
- Update pimcore pimcore to version 10.2.9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | pimcore | pimcore |
< 10.2.9 Fix: upgrade to 10.2.9
|
| – | pimcore | pimcore |
< 10.2.8 cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:* |
Original advisory text
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- https://github.com/advisories/GHSA-v567-q267-phpg
- https://huntr.dev/bounties/bad2073c-bbd5-4425-b3e9-c336b73ddda6 URL
- https://nvd.nist.gov/vuln/detail/CVE-2022-0257 Vendor Advisory
- https://github.com/pimcore/pimcore/commit/dfaf78b26fb77990267c0cc05b9fcb9f8de7b6... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0257.j... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
6.1
Medium
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published17 Jan 2022
Updated31 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta