CVE-2021-39166 HIGH

CVE-2021-39166: Improper Neutralization of Text-Values in Object Version Preview

Vendor Pimcore

Product pimcore

Weakness CWE-79 · XSS

Published September 1, 2021

Last update August 4, 2024

View on NVD All CVEs

CVSS base score

8.0/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources. This issue is patched in Pimcore version 10.1.2.

Key dates

02Disclosure timeline

September 1, 2021 CVE published

August 4, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-39166 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html