{"id":"GHSA-76r7-h46w-463r","aliases":[],"url":"https://o3.security/vulnerability/GHSA-76r7-h46w-463r","summary":"Cross Site Scripting (XSS) in Model\\DataObject\\Data\\UrlSlug","details":"### Impact\nAn attacker can use XSS to send a malicious script to an unsuspecting user.\n\n### Patches\nUpdate to version 10.5.17 or apply this patch manually https://github.com/pimcore/pimcore/pull/14301.patch\n\n### Workarounds\nApply https://github.com/pimcore/pimcore/pull/14301.patch manually.\n\n### References\nhttps://huntr.dev/bounties/75bc7d07-46a7-4ed9-a405-af4fc47fb422/","published":"2023-02-15T18:17:22Z","modified":"2024-12-03T06:05:20.898969Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"pimcore/pimcore","fixedVersion":"10.5.17"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/pimcore/pimcore/security/advisories/GHSA-76r7-h46w-463r"},{"type":"PACKAGE","url":"https://github.com/pimcore/pimcore"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-12-03T06:05:20.898969Z"}}