Reflected XSS In User/Roles Function in pimcore/pimcore


Reported on

Sep 15th 2022



In Setting select User/Roles and select User. After created user, move to Workspace tab and inject payload XSS at Documents, Assets and Data Objects. XSS payload will be trigger.

Besides, Workspace in Roles Also having the same situation. Can you create Role and move to Workspace tab and inject payload to Documents, Assets, Data Objectes.

Proof of Concept

payload =  "><img src=x onerror=alert(2)>

Image PoC: ![PoC_Image] ( "poc")


If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can:

Perform any action within the application that the user can perform. View any information that the user is able to view. Modify any information that the user is able to modify. Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.

We are processing your report and will contact the pimcore team within 24 hours. a year ago
tunght modified the report
a year ago
We have contacted a member of the pimcore team and are waiting to hear back a year ago
pimcore/pimcore maintainer has acknowledged this report a year ago
JiaJia Ji modified the Severity from High (8.8) to Medium (6.8) a year ago
The researcher has received a minor penalty to their credibility for miscalculating the severity: -1
JiaJia Ji validated this vulnerability a year ago
tunght has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
JiaJia Ji marked this as fixed in 10.5.7 with commit 1e916e a year ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation