Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-42817: Pimcore Backend UI Translation Parsing Allows Elevated Access

CVE-2023-42817 · published 3 years ago

Summary

A flaw in Pimcore's Backend UI allows users with limited access to potentially exploit a security weakness. This can be fixed by updating to version 1.1.2 or applying a patch manually. It's recommended to update to the latest version to ensure security.

What to do

Update pimcore admin-ui-classic-bundle to version 1.1.2.
Update pimcore admin_classic_bundle to version 1.1.2 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
composer	pimcore	admin-ui-classic-bundle	< 1.1.2 Fix: upgrade to 1.1.2
–	pimcore	admin_classic_bundle	< 1.1.2 `cpe:2.3:a:pimcore:admin_classic_bundle::::::pimcore::*`

Original advisory text

Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translations

Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user. The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box. This issue has been patched in commit `abd77392` which is included in release 1.1.2. Users are advised to update to version 1.1.2 or apply the patch manually.

References

https://github.com/advisories/GHSA-m988-7375-7g2c
https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-m988... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-42817 Vendor Advisory
https://github.com/pimcore/admin-ui-classic-bundle/commit/abd7739298f974319e3cac... Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42817... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.4 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published25 Sep 2023

Updated4 Nov 2026

First seen6 Mar 2026

Sources

GHSA-m988-7375-7g2c · GHSA

CVE-2023-42817 · NVD

CVE-2023-42817 · OSV

Track software like this

Free during beta