What’s Vulnerable › Vulnerabilities

CVE-2023-28429: Pimcore has Cross-site Scripting vulnerability in DataObject tooltip field

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-03-20 · updated 2026-06-17
• Weakness: CWE-79

Description

Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 10.5.19 or, as a workaround, apply the patch manually.

Affected products

• pimcore/pimcore: before 10.5.19 — fixed in 10.5.19

How to fix

Upgrade to a fixed version: pimcore/pimcore 10.5.19. Check the vendor advisory for mitigations.

References

• https://github.com/pimcore/pimcore/pull/14574
• https://github.com/pimcore/pimcore/pull/14574.patch
• https://github.com/pimcore/pimcore/security/advisories/GHSA-rcg9-hrhx-6q69
• https://github.com/pimcore/pimcore/pull/14574
• https://github.com/pimcore/pimcore/pull/14574.patch
• https://github.com/pimcore/pimcore/security/advisories/GHSA-rcg9-hrhx-6q69

Get alerted when CVE-2023-28429 or the next vulnerability affects your stack