An improper neutralization of input during web page generation [CWE-79] vulnerability in FortiOS versions 7.0.0 to 7.0.7 and 7.2.0 to 7.2.3 may allow a remote, unauthenticated attacker to launch a cross site scripting (XSS) attack via the "redir" parameter of the URL seen when the "Sign in with FortiCloud" button is clicked.

** PSIRT Advisories**

**FortiOS -- XSS vulnerability in the Login page when FortiCloud Sign-in is used**

**Summary**

An improper neutralization of input during web page generation \[CWE-79\] vulnerability in FortiOS may allow a remote, unauthenticated attacker to launch a cross site scripting (XSS) attack via the "redir" parameter of the URL seen when the "Sign in with FortiCloud" button is clicked.  
 

**Affected Products**

FortiOS version 7.2.0 through 7.2.3  
FortiOS version 7.0.0 through 7.0.7

**Solutions**

Please upgrade to FortiOS version 7.2.4 or above  
Please upgrade to FortiOS version 7.0.8 or above

Workaround:  
Disable "Sign in with FortiCloud" feature using the below command  
config system global 

set admin-forticloud-sso-login disable

 end

 and use other authentication methods to login to FortiGate.  

**Acknowledgement**

Fortinet is pleased to thank Gabriel Ottoboni for reporting this vulnerability under responsible disclosure.

CVE-2022-41334: Fortiguard

An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.

**Security Announcements**

**\[20230201\] - Core - Improper access check in webservice endpoints**

*   **Project:** Joomla!
*   **SubProject:** CMS
*   **Impact:** Critical
*   **Severity:** High
*   **Probability:** High
*   **Versions:** 4.0.0-4.2.7
*   **Exploit type:** Incorrect Access Control
*   **Reported Date:** 2023-02-13
*   **Fixed Date:** 2023-02-16
*   **CVE Number:** CVE-2023-23752

**Description**

An improper access check allows unauthorized access to webservice endpoints.

**Affected Installs**

Joomla! CMS versions 4.0.0-4.2.7

**Solution**

Upgrade to version 4.2.8

**Contact**

The JSST at the Joomla! Security Centre.

**Reported By:**  Zewei Zhang from NSFOCUS TIANJI Lab

Next article: \[20221101\] - Core - RXSS through reflection of user input in com\_media

1.  You are here:  
2.  Home
3.  Security Announcements
4.  \[20230201\] - Core - Improper access check in webservice endpoints

CVE-2023-23752: Joomla! Developer Network

Cross site scripting (XSS) vulnerability in flatCore-CMS 2.2.15 allows attackers to execute arbitrary code via description field on the new page creation form.

**Describe the bug**  
An user with page creation/edition can create an XSS payload in description field to trigger XSS when view all page from admin panel  
**To Reproduce**  
Steps to reproduce the behavior:

1.  Click on 'Create New Page'
2.  Go to 'Meta Tags' tab
3.  In the 'description' section, insert arbitrary XSS payload
4.  Go to 'See all page'
5.  See error

**Expected behavior**  
The XSS payload will be triggered for anyone who view this page description (esspecially admin account).

**Screenshots**  

**Desktop (please complete the following information):**

*   OS: tested on kali linux
*   Browser: tested on firefox
*   Version: 2.0.7

**video PoC**  
https://youtu.be/XkjPdJvnMQ0

**Additional context**  
This bug can be exploited by anyone has edit/create page privileges

CVE-2021-40555: XSS in page description · Issue #56 · flatCore/flatCore-CMS

Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain escalated privileges.

**Cross-site Scripting in kimai/kimai**

Moderate severity GitHub Reviewed Published Feb 16, 2023 to the GitHub Advisory Database • Updated Feb 16, 2023

GHSA-r58m-v5pr-jhhq: Cross-site Scripting in kimai/kimai

Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain escalated privileges.

    

**Kimai - time-tracker**

Kimai is a professional grade time-tracking application, free and open-source. It handles use-cases of freelancers as well as companies with dozens or hundreds of users. Kimai was build to track your project times and ships with many advanced features, including but not limited to:

JSON API, invoicing, data exports, multi-timer and punch-in punch-out mode, tagging, multi-user - multi-timezones - multi-language (over 30 translations existing!), authentication via SAML/LDAP/Database, two-factor authentication (2FA) with TOTP, customizable role and team permissions, responsive design, user/customer/project specific rates, advanced search & filtering, money and time budgets, advanced reporting, support for plugins and so much more.

**Versions**

There are two versions of Kimai existing:

*   Version 1 — compatible with PHP 7.4, which is in maintenance mode since 2023
*   Version 2 — stable and "almost released" (waiting for some major plugins, which are not yet migrated)

**Links**

*   Home — Kimai project homepage
*   Blog — Read the latest news
*   Documentation — Learn how to use Kimai

**Requirements**

*   PHP 8.1 minimum
*   MariaDB or MySQL
*   A webserver and subdomain (subdirectory is not supported)
*   PHP extensions: gd, intl, json, mbstring, pdo, tokenizer, xml, xsl, zip

**Installation**

*   Recommended setup — with Git and Composer
*   Docker — containerized by @tobybatch

There are also documentations for:

*   developer setups — on your local machine
*   shared hostings — the least favorable option
*   Synology — you could try to host the Docker version instead
*   1-click installer — hosted environments

And if you don't want to host Kimai, you can use the Cloud version of it.

**Updating Kimai**

*   Update Kimai — get the latest version
*   UPGRADING guide — version specific steps

**Plugins**

*   Plugin marketplace — find existing plugins here
*   Developer documentation — how to create a plugin

**Roadmap and releases**

You can see a rough development roadmap in the Milestones sections. It is open for changes and input from the community, your ideas and questions are welcome.

Release versions will be created on a regular basis, every couple of weeks latest. Every code change, whether it's a new feature or a bugfix, will be done on the main branch.

For the time being and until 2.0 is widely adopted, the 1.x branch will receive bug fixes.

**Contributing**

You want to contribute to this repository? This is so great! The best way to start is to open a new issue for bugs or feature requests or a discussion for questions, support and such.

In case you want to contribute, but you wouldn't know how, here are some suggestions:

*   Spread the word: More user means more people testing and contributing to Kimai, which in turn means better stability and more and better features. Please vote for Kimai on any software platform, you can toot or tweet about it, share it on LinkedIn, Reddit or any of your favorite social media platforms. Every bit helps!
*   Answer questions: You know the answer to another user's problem? Share your knowledge.
*   Something can be done better? An essential feature is missing? Create a feature request.
*   Report bugs makes Kimai better for everyone.
*   You don't have to be programmer, the documentation and translation could always use some attention.
*   Sponsor the project: free software costs money to create!

There is one simple rule in our "Code of conduct": Don't be an ass!

**Credits**

Kimai is based on modern technologies and frameworks such as PHP, Symfony and Doctrine, Bootstrap and Tabler, and countless others.

CVE-2020-19825: GitHub - kimai/kimai: Kimai is a web-based multi-user time-tracking application. Works great for everyone: freelancers, companies, organizations - everyone can track their times, generate reports, cre

Cross site scripting (XSS) vulnerability in DiscuzX 3.4 allows attackers to execute arbitrary code via the datetline, title, tpp, or username parameters via the audit search.

**Description**

Admin backend audit search of content audit component with reflected-XSS in POST value “dateline”, “title”, “tpp” and “username”, which bypassed discuz security check and even could hijack callback url link, and it can also inject javascript to setTimeout at the end of html response.

**Affected Version**

DiscuzX <= 3.4, SC\_UTF8\_20221111

**POC**

1  
2  
3  
4  
5  
6  
7  
8  
9  
10  
11  
12  
13  
14  
15  
16  

POST /cms/discuz/upload/admin.php?action=moderate&operation=threads HTTP/1.1  
Host: 192.168.0.4  
Content-Length: 166  
Cache-Control: max-age=0  
Upgrade-Insecure-Requests: 1  
Origin: http://192.168.0.4  
Content-Type: application/x-www-form-urlencoded  
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_15\_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed-exchange;v=b3;q=0.9  
Referer: http://192.168.0.4/cms/discuz/upload/admin.php?action=moderate&operation=threads  
Accept-Encoding: gzip, deflate  
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8  
Cookie: 5Kkn\_2132\_saltkey=y03s5T45; 5Kkn\_2132\_lastvisit=1668496347; 5Kkn\_2132\_ulastactivity=07108qps3b3FkXEEZNxrT%2BtyQpXYN9%2FSOodQCNbMLoO%2BO6DOk8pF; 5Kkn\_2132\_auth=7791L55DZFdkAgcM5rDcnjIiVH0t%2BptlGCIqLkAhUIRMsUDTnq%2BGi7atBCt%2BPdyl2mCVv0hA3jA%2BxaOfDB1h; 5Kkn\_2132\_lastcheckfeed=1%7C1668501456; 5Kkn\_2132\_nofavfid=1; 5Kkn\_2132\_sid=yhpz44; 5Kkn\_2132\_lip=172.17.0.1%2C1668502019; 5Kkn\_2132\_lastact=1668502045%09admin.php%09  
Connection: close  
  
formhash=288a0c1d&scrolltop=&anchor=&username=aa&title=aa&tpp=20&filter=normal&modfid=all&dateline=604"></a><script>alert(1)</script><!--&modsubmit=%E6%8F%90%E4%BA%A4  

**Reference**

*   Gitee Issues (Login Required)
*   CVE

> Reported by Srpopty, vulnerability discovered by using Corax.

CVE-2022-45543: Vulnerability - Discuz X3.4 Backend Reflected XSS (CVE-2022-45543)

Missing permission checks in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

This advisory announces vulnerabilities in the following Jenkins deliverables:

*   Azure Credentials Plugin
*   Email Extension Plugin
*   JUnit Plugin
*   Pipeline: Build Step Plugin
*   Synopsys Coverity Plugin

**Descriptions****Stored XSS vulnerability in JUnit Plugin**

**SECURITY-3032 / CVE-2023-25761**  
**Severity (CVSS):** High  
**Affected plugin: junit**  
**Description:**

JUnit Plugin 1166.va\_436e268e972 and earlier does not escape test case class names in JavaScript expressions.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.

JUnit Plugin 1166.1168.vd6b\_8042a\_06de escapes affected test case class names in JavaScript expressions.

**Stored XSS vulnerability in Pipeline: Build Step Plugin**

**SECURITY-3019 / CVE-2023-25762**  
**Severity (CVSS):** High  
**Affected plugin: pipeline-build-step**  
**Description:**

Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.

Pipeline: Build Step Plugin 2.18.1 escapes job names in the affected JavaScript expression.

**XSS vulnerability in bundled email templates in Email Extension Plugin**

**SECURITY-2931 / CVE-2023-25763**  
**Severity (CVSS):** High  
**Affected plugin: email-ext**  
**Description:**

Email Extension Plugin bundled multiple preconfigured templates for notification emails. The Email Template Testing feature can be used to see what these and other templates would look like based on a given build.

Email Extension Plugin 2.93 and earlier does not escape various fields included in those email templates, like build display name, user display name, and the names of tests.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control affected fields.

Email Extension Plugin 2.93.1 escapes affected fields in bundled email templates.

**Stored XSS vulnerability in custom email templates in Email Extension Plugin**

**SECURITY-2934 / CVE-2023-25764**  
**Severity (CVSS):** High  
**Affected plugin: email-ext**  
**Description:**

Email Extension Plugin allows defining custom email templates using Config File Provider plugin as Jelly or Groovy files. The Email Template Testing feature can be used to see what these templates would look like based on a given build by specifying the managed: name prefix.

Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generated during template rendering.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or change custom email templates.

Email Extension Plugin 2.93.1 renders email template previews inside a sandboxed iframe.

**Script Security sandbox bypass vulnerability in Email Extension Plugin**

**SECURITY-2939 / CVE-2023-25765**  
**Severity (CVSS):** High  
**Affected plugin: email-ext**  
**Description:**

Email Extension Plugin allows defining custom email templates using Config File Provider plugin as Jelly or Groovy files. When defined inside a folder, email templates need to be subject to Script Security protection (sandboxed execution or full-script approval).

In Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection.

This vulnerability allows attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Email templates defined in folders are subject to sandbox protection in Email Extension Plugin 2.93.1.

**Missing permission checks in Azure Credentials Plugin allow enumerating credentials IDs**

**SECURITY-1757 / CVE-2023-25766**  
**Severity (CVSS):** Medium  
**Affected plugin: azure-credentials**  
**Description:**

Azure Credentials Plugin 253.v887e0f9e898b and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in Azure Credentials Plugin 254.v64da\_8176c83a requires Overall/Administer permission.

**CSRF vulnerability and missing permission checks in Azure Credentials Plugin**

**SECURITY-1756 / CVE-2023-25767 (CSRF), CVE-2023-25768 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: azure-credentials**  
**Description:**

Azure Credentials Plugin 253.v887e0f9e898b and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified web server.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

These form validation methods require POST requests and Overall/Administer permission in Azure Credentials Plugin 254.v64da\_8176c83a.

**Missing permission checks in Synopsys Coverity Plugin allow enumerating credentials IDs**

**SECURITY-2793 (1) / CVE-2023-23850**  
**Severity (CVSS):** Medium  
**Affected plugin: synopsys-coverity**  
**Description:**

Synopsys Coverity Plugin 3.0.2 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in Synopsys Coverity Plugin 3.0.3 requires the appropriate permissions.

**CSRF vulnerability and missing permission checks in Synopsys Coverity Plugin allow capturing credentials**

**SECURITY-2793 (2) / CVE-2023-23847 (CSRF), CVE-2023-23848 (missing permission check)**  
**Severity (CVSS):** High  
**Affected plugin: synopsys-coverity**  
**Description:**

Synopsys Coverity Plugin 3.0.2 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Synopsys Coverity Plugin 3.0.3 requires POST requests and the appropriate permissions for the affected HTTP endpoints.

**Severity**

*   SECURITY-1756: Medium
*   SECURITY-1757: Medium
*   SECURITY-2793 (1): Medium
*   SECURITY-2793 (2): High
*   SECURITY-2931: High
*   SECURITY-2934: High
*   SECURITY-2939: High
*   SECURITY-3019: High
*   SECURITY-3032: High

**Affected Versions**

*   **Azure Credentials Plugin** up to and including 253.v887e0f9e898b
*   **Email Extension Plugin** up to and including 2.93
*   **JUnit Plugin** up to and including 1166.va\_436e268e972
*   **Pipeline: Build Step Plugin** up to and including 2.18
*   **Synopsys Coverity Plugin** up to and including 3.0.2

**Fix**

*   **Azure Credentials Plugin** should be updated to version 254.v64da\_8176c83a
*   **Email Extension Plugin** should be updated to version 2.93.1
*   **JUnit Plugin** should be updated to version 1166.1168.vd6b\_8042a\_06de
*   **Pipeline: Build Step Plugin** should be updated to version 2.18.1
*   **Synopsys Coverity Plugin** should be updated to version 3.0.3

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

**Credit**

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

*   **Daniel Beck, CloudBees, Inc.** for SECURITY-2793 (1), SECURITY-2793 (2)
*   **Kevin Guerroudj, CloudBees, Inc.** for SECURITY-3019, SECURITY-3032
*   **Wadeck Follonier, CloudBees, Inc.** for SECURITY-1756, SECURITY-1757
*   **Yaroslav Afenkin, CloudBees, Inc.** for SECURITY-2931, SECURITY-2939
*   **Yaroslav Afenkin, CloudBees, Inc. and independently, Valdes Che Zogou** for SECURITY-2934

CVE-2023-23848: Jenkins Security Advisory 2023-02-15

A missing permission check in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

CVE-2023-23850: Jenkins Security Advisory 2023-02-15

B&R Systems Diagnostics Manager versions above or equal to 3.00 and below or equal to C4.93 suffer from a cross site scripting vulnerability.

SEC Consult Vulnerability Lab Security Advisory < 20230214-0 >  
=======================================================================  
               title: Multiple XSS Vulnerabilities  
             product: B&R Systems Diagnostics Manager  
  vulnerable version: >=3.00 and <=C4.93  
       fixed version: >=D4.93  
          CVE number: CVE-2022-4286  
              impact: medium  
            homepage: https://www.br-automation.com  
               found: 2022-10-28  
                  by: S. Robertz (Office Vienna)  
                      G. Hechenberger (Office Vienna)  
                      SEC Consult Vulnerability Lab

                      An integrated part of SEC Consult, an Atos company  
                      Europe | Asia | North America

                      https://www.sec-consult.com

=======================================================================

Vendor description:  
-------------------  
"Our slogan is our mission. The pursuit of Perfection in Automation has  
inspired and guided B&R for over 40 years. To us, perfection means more  
than developing the best solutions in industrial automation. It also means  
developing the best relationships – with our customers and partners as  
well as our employees and suppliers.

Keen foresight and entrepreneurial courage helped us rise quickly into  
the ranks of top global players in industrial automation. An intuitive sense  
of market dynamics and emerging trends has established us as a pioneer,  
leading the way with the most innovative technology on the market.

Our role as the ABB Group's global center for machine and factory automation  
strengthens our position of leadership and adds new momentum to our  
impressive record of sustained growth."

Source: https://www.br-automation.com/en/about-us/

Business recommendation:  
------------------------  
The vendor provides a software update which should be installed immediately.

SEC Consult highly recommends to perform a thorough security review of the  
product conducted by security professionals to identify and resolve potential  
further security issues.

Vulnerability overview/description:  
-----------------------------------  
1) Multiple Reflected Cross-Site-Scripting Vulnerabilities (CVE-2022-4286)  
An attacker can execute arbitrary JavaScript code in the context of the  
victim's session, thus perform all actions, exfiltrate information, etc.  
In order to exploit this vulnerability the attacker will have to trick  
the user into visiting a manipulated URL.

Proof of concept:  
-----------------  
1) Multiple Reflected Cross-Site-Scripting Vulnerabilities (CVE-2022-4286)  
The following URL has to be visited by the victim in order to execute  
arbitrary JavaScript code.

http://<PLC-IP>/sdm/cgiFileLoop.cgi?service=javascript:alert(document.domain);%2f%2f&type=512&scope=%3Cfile:///etc/passwd%3E&module=Snapshot&option=3

A very similar vulnerability can be found at another endpoint of the  
System Diagnostic Manager (SDM).

http://<PLC-IP>/sdm/svg.cgi?type=cpuusage&index=1%3Cscript%3Ealert(document.domain)%3C/script%3E

Vulnerable / tested versions:  
-----------------------------  
The following device and firmware version has been tested:  
* B&R X20CP3687X SwModuleVersion 186

According to the vendor, all B&R Automation Runtime (AR) versions >=3.00 and <=C4.93  
are affected.

Vendor contact timeline:  
------------------------  
2022-11-21: Contacting vendor through cybersecurity@br-automation.com.  
             Sent encrypted advisory.  
2022-11-22: Vendor requests B&R Automation Runtime version.  
2022-12-01: Vendor confirms vulnerability. Will be fixed with next release.  
             Asking for timeline.  
2022-12-13: Advisory and patch will be published on 2023-02-10.  
             Vendor offers to share the advisory for review purposes.  
2023-01-25: Reviewing vendor advisory, receiving CVE + affected/fixed version  
             numbers  
2023-02-10: Vendor provides the patch.  
2023-02-14: Coordinated release of security advisory.

Solution:  
---------  
The vendor supplies a patch, which should be installed immediately.  
The following version mitigates the identified XSS issues:  
* B&R Automation Runtime version >=D4.93

The vendor has published the following security advisory:  
https://www.br-automation.com/downloads_br_productcatalogue/assets/1675607299099-en-original-1.0.pdf

Workaround:  
-----------  
Administrators can deactivate the System Diagnostics Manager in case it is not  
needed.

Advisory URL:  
-------------  
https://sec-consult.com/vulnerability-lab/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab

SEC Consult, an Atos company  
Europe | Asia | North America

About SEC Consult Vulnerability Lab  
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an  
Atos company. It ensures the continued knowledge gain of SEC Consult in the  
field of network and application security to stay ahead of the attacker. The  
SEC Consult Vulnerability Lab supports high-quality penetration testing and  
the evaluation of new offensive and defensive technologies for our customers.  
Hence our customers obtain the most current information about vulnerabilities  
and valid recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
Interested to work with the experts of SEC Consult?  
Send us your application https://sec-consult.com/career/

Interested in improving your cyber security with the experts of SEC Consult?  
Contact our local offices https://sec-consult.com/contact/  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: security-research at sec-consult dot com  
Web: https://www.sec-consult.com  
Blog: http://blog.sec-consult.com  
Twitter: https://twitter.com/sec_consult  
EOF S. Robertz, G. Hechenberger / @2023

B&R Systems Diagnostics Manager Cross Site Scripting

### Impact
An attacker can use XSS to send a malicious script to an unsuspecting user.

### Patches
Update to version 10.5.17 or apply this patch manually https://github.com/pimcore/pimcore/pull/14301.patch

### Workarounds
Apply https://github.com/pimcore/pimcore/pull/14301.patch manually.

### References
https://huntr.dev/bounties/75bc7d07-46a7-4ed9-a405-af4fc47fb422/

Skip to content

*   *   Actions
        
        Automate any workflow
        
    *   Packages
        
        Host and manage packages
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Codespaces
        
        Instant dev environments
        
    *   Copilot
        
        Write better code with AI
        
    *   Code review
        
        Manage code changes
        
    *   Issues
        
        Plan and track work
        
    *   Discussions
        
        Collaborate outside of code
        
    
    *   Explore
    *   All features
    *   Documentation
    *   GitHub Skills
    *   Blog
    
*   *   For
    *   Enterprise
    *   Teams
    *   Startups
    *   Education
    
    *   By Solution
    *   CI/CD & Automation
    *   DevOps
    *   DevSecOps
    
    *   Case Studies
    *   Customer Stories
    *   Resources
    
*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
    *   Repositories
    *   Topics
    *   Trending
    *   Collections
    
*   Pricing

Tag

#xss