CVE-2018-14059: Cross-site Scripting

August 24, 2018 (updated November 1, 2018)

Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions.

References

packetstormsecurity.com/files/148954/Pimcore-5.2.3-CSRF-Cross-Site-Scripting-SQL-Injection.html
nvd.nist.gov/vuln/detail/CVE-2018-14059
www.exploit-db.com/exploits/45208/

Detect and mitigate CVE-2018-14059 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →