CVE-2022-3255
Medium
Description
If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is able to view. Modify any information that the user is able to modify. Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.
SeverityMedium
CVSS4.8
Exploit probability—
Product
Pimcore
PublishedSep 21, 2022
First seenSep 21, 2022
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- pimcore pimcore10.5.7 or later
- pimcore/pimcore10.5.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pimcore pimcore | v < 10.5.7 | 10.5.7 |
| pimcore/pimcorePackagist | v < 10.5.7 | 10.5.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.