CVE-2021-39166

Description

Text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources.

Affected packages (1)

• Packagist/pimcore/pimcorefrom 0, < 10.1.2

CVSS scores

References (4)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-39166
• PATCHhttps://github.com/pimcore/pimcore
• WEBhttps://github.com/pimcore/pimcore/pull/10170
• WEBhttps://github.com/pimcore/pimcore/security/advisories/GHSA-w6j8-jc36-x5q9