{"id":"CVE-2023-2730","published":"2023-05-16T00:00:00Z","modified":"2025-01-22T21:17:58Z","title":"Cross-site Scripting (XSS) - Stored in pimcore/pimcore","vendor":"pimcore","product":"pimcore/pimcore","tier":"tail","description":{"text":"Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00479,"percentile":0.41196,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/pimcore/pimcore/commit/8ab06bfbb5a05a1b190731d9c7476ec45f5ee878","tags":[]},{"url":"https://huntr.dev/bounties/6c6f5c26-d545-4e7b-82bb-1fe28006c885","tags":[]}],"priority":{"score":12.6,"factors":[{"name":"EPSS percentile","points":8.24},{"name":"CVSS severity","points":4.41}]},"vendorSlug":"pimcore","affectedVersions":[{"vendor":"pimcore","product":"pimcore/pimcore","versions":[">= unspecified, < 10.3.3"]}],"affected":[{"ecosystem":"Packagist","package":"pimcore/pimcore","vulnerableRanges":["<10.3.3"],"patched":["10.3.3"],"from":["GHSA-q3p4-v2cm-q945"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1606","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-0665","published":"2022-02-22","fixed":"10.3.2","kev":false,"link":{"from":"CVE-2022-0665","to":"CVE-2023-2730","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:pimcore/pimcore","fromFixed":"10.3.2","toFixed":"10.3.3","daysApart":448}]}},{"cve":"CVE-2022-0831","published":"2022-03-04","fixed":"10.3.3","kev":false},{"cve":"CVE-2022-0832","published":"2022-03-04","fixed":"10.3.3","kev":false},{"cve":"CVE-2023-2730","published":"2023-05-16","fixed":"10.3.3","kev":false},{"cve":"CVE-2022-1219","published":"2022-04-08","fixed":"10.3.5","kev":false},{"cve":"CVE-2022-1339","published":"2022-04-13","fixed":"10.3.5","kev":false},{"cve":"CVE-2022-1429","published":"2022-04-22","fixed":"10.3.6","kev":false}],"package":"Packagist:pimcore/pimcore"}}