GHSA-8m2r-x2m2-3wmw

Suggest an improvement
Source
https://github.com/advisories/GHSA-8m2r-x2m2-3wmw
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-8m2r-x2m2-3wmw/GHSA-8m2r-x2m2-3wmw.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8m2r-x2m2-3wmw
Withdrawn
2025-11-04T19:43:57Z
Published
2025-01-28T15:31:57Z
Modified
2026-09-10T03:50:56Z
Severity
  • 2.4 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
Duplicate Advisory: Pimcore Authenticated Stored Cross-Site Scripting (XSS) Via Search Document
Details

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xr3m-6gq6-22cg. This link is maintained to preserve external references.

Original Description A vulnerability classified as problematic was found in Pimcore 11.4.2. Affected by this vulnerability is an unknown functionality of the component Search Document. The manipulation leads to basic cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Database specific 
{
    "cwe_ids":  [
        "CWE-74"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-11-04T19:43:57Z",
    "nvd_published_at":  "2025-01-28T14:15:29Z",
    "severity":  "MODERATE"
}
References

Affected packages

Packagist / pimcore/pimcore

Package

Name
pimcore/pimcore
Purl
pkg:composer/pimcore/pimcore

Affected ranges

Type
ECOSYSTEM
Events
Introduced
11.4.2

Affected versions

v11.*
v11.4.2
v11.4.3
v11.4.4
v11.5.0-RC1
v11.5.0-RC2
v11.5.0
v11.5.1
v11.5.2
v11.5.3
v11.5.4
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.14.1
v12.*
v12.0.0-RC1
v12.0.0-RC2
v12.0.0
v12.0.1
v12.0.2
v12.0.3
v12.0.4
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.1.4
v12.1.5
v12.2.0
v12.2.1
v12.2.2
v12.2.3
v12.2.4
v12.3.0
v12.3.1
v12.3.1.1
v12.3.2
v12.3.3
v12.3.4
v12.3.5
v12.3.6
v12.3.7
v12.3.8
v12.3.9
v12.3.10
v12.3.11
v12.3.12
v12.3.12.1
v2026.*
v2026.1.0
v2026.1.1
v2026.1.2
v2026.1.3
v2026.1.4
v2026.1.5
v2026.1.6
v2026.1.7
v2026.2.0
v2026.2.1
v2026.2.2
v2026.2.3
v2026.2.4
v2026.2.5
v2026.2.6
v2026.2.7
v2026.2.8
v2026.2.9
v2026.2.10
v2026.2.11
v2026.2.12

Database specific

last_known_affected_version_range 
"< 11.5.3"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-8m2r-x2m2-3wmw/GHSA-8m2r-x2m2-3wmw.json"