medium4.8
CVE-2022-0955
Cross-site Scripting in Pimcore Datahub
Impact
Pimcore Datahub prior to 1.2.4 is vulnerable to stored cross-site scripting. An admin user accessing Datahub triggers the attack, which may result in the user's cookie being stolen.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | pimcore/data-hub | < 1.2.4 | 1.2.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pimcore | Data-Hub | before 1.2.4 |