{"id":"CVE-2018-14059","published":"2018-08-24T22:00:00Z","modified":"2024-08-05T09:21:40Z","title":"Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections…","vendor":null,"product":null,"tier":"tail","description":{"text":"Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03121,"percentile":0.87793,"provenance":"source"},"cwes":[],"references":[{"url":"http://seclists.org/fulldisclosure/2018/Aug/13","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://packetstormsecurity.com/files/148954/Pimcore-5.2.3-CSRF-Cross-Site-Scripting-SQL-Injection.html","tags":["x_refsource_MISC"]},{"url":"https://www.sec-consult.com/en/blog/advisories/sql-injection-xss-csrf-vulnerabilities-in-pimcore-software/","tags":["x_refsource_MISC"]},{"url":"https://www.exploit-db.com/exploits/45208/","tags":["exploit","x_refsource_EXPLOIT-DB"]}],"priority":{"score":22.6,"factors":[{"name":"EPSS percentile","points":17.56},{"name":"Public exploit code","points":5.0}]},"exploitSources":{"exploitdb":{"count":3,"earliest":"2018-08-16"},"first":{"date":"2018-08-16","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/45208"},"provenance":"source"},"affected":[{"ecosystem":"Packagist","package":"pimcore/pimcore","vulnerableRanges":["<5.3.0"],"patched":["5.3.0"],"from":["GHSA-276r-24xq-hwg8"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-1927","exploited":false,"provenance":"source"},"exploits":[{"id":45208,"url":"https://www.exploit-db.com/exploits/45208","title":"Pimcore 5.2.3 - SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery","date":"2018-08-16","verified":false,"provenance":"source"},{"id":45208,"url":"https://www.exploit-db.com/exploits/45208","title":"Pimcore 5.2.3 - SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery","date":"2018-08-16","verified":false,"provenance":"source"},{"id":45208,"url":"https://www.exploit-db.com/exploits/45208","title":"Pimcore 5.2.3 - SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery","date":"2018-08-16","verified":false,"provenance":"source"}],"exploitRefs":["https://www.exploit-db.com/exploits/45208/","http://packetstormsecurity.com/files/148954/Pimcore-5.2.3-CSRF-Cross-Site-Scripting-SQL-Injection.html","https://www.exploit-db.com/exploits/45208"],"lineage":{"packageHistory":[{"cve":"CVE-2014-2921","published":"2014-04-21","fixed":"2.2.0","kev":false},{"cve":"CVE-2018-14057","published":"2018-08-17","fixed":"5.3.0","kev":false},{"cve":"CVE-2018-14058","published":"2018-08-17","fixed":"5.3.0","kev":false},{"cve":"CVE-2018-14059","published":"2018-08-24","fixed":"5.3.0","kev":false},{"cve":"CVE-2019-10867","published":"2019-04-04","fixed":"5.7.1","kev":false,"link":{"from":"CVE-2018-14059","to":"CVE-2019-10867","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:pimcore/pimcore","fromFixed":"5.3.0","toFixed":"5.7.1","daysApart":223}]}},{"cve":"CVE-2019-16317","published":"2019-09-14","fixed":"5.7.1","kev":false,"link":{"from":"CVE-2018-14059","to":"CVE-2019-16317","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:pimcore/pimcore","fromFixed":"5.3.0","toFixed":"5.7.1","daysApart":386}]}},{"cve":"CVE-2019-16318","published":"2019-09-14","fixed":"5.7.1","kev":false,"link":{"from":"CVE-2018-14059","to":"CVE-2019-16318","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:pimcore/pimcore","fromFixed":"5.3.0","toFixed":"5.7.1","daysApart":386}]}}],"package":"Packagist:pimcore/pimcore"}}