{"items":[{"id":"NVI-00007047","kind":"vulnerability","title":"Pimcore admin UI vulnerable to Cross-site Scripting in 2 factor authentication setup page","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-hqv9-6jqw-9g8m","CVE-2023-37280"],"plain_summary":"OSV carries this publisher advisory for pimcore/admin-ui-classic-bundle. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 1.0.3 for pimcore/admin-ui-classic-bundle. Confirm the publisher’s latest guidance.","source_ids":["sr-ccb4a8b4059464538e3325ac3f11dc6a"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-016b01d202c78b978d9ff2f0767f26da"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-17T06:07:52.720Z","value":"5 MEDIUM (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-bf45d7420c7f554dd6b6e7d11b95a7df"},{"kind":"CVSS","as_of":"2026-06-17T06:07:52.720Z","value":"6.1 MEDIUM (3.1)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-bf45d7420c7f554dd6b6e7d11b95a7df"},{"kind":"EPSS","as_of":"2026-11-04T12:03:12.000Z","value":"0.578%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.47698. Missing scores are unknown.","source_id":"sr-016b01d202c78b978d9ff2f0767f26da"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-ccb4a8b4059464538e3325ac3f11dc6a","url":"https://github.com/advisories/GHSA-hqv9-6jqw-9g8m","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-hqv9-6jqw-9g8m","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:20.432Z"},{"id":"sr-bf45d7420c7f554dd6b6e7d11b95a7df","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37280","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2023-37280","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-01T00:58:44.011Z"},{"id":"sr-016b01d202c78b978d9ff2f0767f26da","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2023-37280","publisher":"FIRST EPSS","observed_at":"2026-11-04T17:57:29.219Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-ccb4a8b4059464538e3325ac3f11dc6a"],"technology":"pimcore/admin-ui-classic-bundle","known_exclusions":[],"conditions_summary":"### Summary\n\nUnauthenticated HTML Injection / XSS Possible.\nConditions: 2factor authentication must not set before\n\n Vulnerable Endpoint: /admin/login/2fa-setup\n\n Vulnerable Param: error=\nHow it works, So basically any admin, who has not setup 2 factor authentication before is vulnerable for this attack, without need for any form of privilege, causing the application to execute arbitrary scripts / HTML Contents.\n\nAnother potential attack vector, as it's a 2fa page and it has QR Code, attacker can replace this QR Code with something he has, leading to increase threat to the admin.\n\nThis attack can be used to execute arbitrary scripts or HTML Injection, causing the target application to execute these resulting in cookie steeling, defacement or Injecting phishing URLs on the target application.\n\n### Patches\nUpdate to version 1.0.3 or apply this patches manually\nhttps://github.com/pimcore/admin-ui-classic-bundle/commit/5fcd19bdc89a3fe4cb8ad8c356590e1e4740c743.patch\n\n### Workarounds\nApply patches manually: https://github.com/pimcore/admin-ui-classic-bundle/commit/5fcd19bdc89a3fe4cb8ad8c356590e1e4740c743.patch\n\n### References\nhttps://huntr.dev/bounties/1fa1cc3b-75ff-4d34-99ae-4a705eb623e","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 1.0.3"]}],"null_published_at":"2026-11-07T22:29:23.380Z","source_updated_at":"2024-02-22T05:32:34.098Z","source_disclosed_at":"2023-07-12T17:29:02.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:42:20.432Z"},{"id":"NVI-00007047","kind":"vulnerability","title":"Pimcore admin UI vulnerable to Cross-site Scripting in 2 factor authentication setup page","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-hqv9-6jqw-9g8m","CVE-2023-37280"],"plain_summary":"OSV carries this publisher advisory for pimcore/admin-ui-classic-bundle. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 1.0.3 for pimcore/admin-ui-classic-bundle. Confirm the publisher’s latest guidance.","source_ids":["sr-ccb4a8b4059464538e3325ac3f11dc6a"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-016b01d202c78b978d9ff2f0767f26da"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-11-04T12:03:12.000Z","value":"0.578%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.47698. Missing scores are unknown.","source_id":"sr-016b01d202c78b978d9ff2f0767f26da"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-ccb4a8b4059464538e3325ac3f11dc6a","url":"https://github.com/advisories/GHSA-hqv9-6jqw-9g8m","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-hqv9-6jqw-9g8m","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:20.432Z"},{"id":"sr-016b01d202c78b978d9ff2f0767f26da","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2023-37280","publisher":"FIRST EPSS","observed_at":"2026-11-04T17:57:29.219Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-ccb4a8b4059464538e3325ac3f11dc6a"],"technology":"pimcore/admin-ui-classic-bundle","known_exclusions":[],"conditions_summary":"### Summary\n\nUnauthenticated HTML Injection / XSS Possible.\nConditions: 2factor authentication must not set before\n\n Vulnerable Endpoint: /admin/login/2fa-setup\n\n Vulnerable Param: error=\nHow it works, So basically any admin, who has not setup 2 factor authentication before is vulnerable for this attack, without need for any form of privilege, causing the application to execute arbitrary scripts / HTML Contents.\n\nAnother potential attack vector, as it's a 2fa page and it has QR Code, attacker can replace this QR Code with something he has, leading to increase threat to the admin.\n\nThis attack can be used to execute arbitrary scripts or HTML Injection, causing the target application to execute these resulting in cookie steeling, defacement or Injecting phishing URLs on the target application.\n\n### Patches\nUpdate to version 1.0.3 or apply this patches manually\nhttps://github.com/pimcore/admin-ui-classic-bundle/commit/5fcd19bdc89a3fe4cb8ad8c356590e1e4740c743.patch\n\n### Workarounds\nApply patches manually: https://github.com/pimcore/admin-ui-classic-bundle/commit/5fcd19bdc89a3fe4cb8ad8c356590e1e4740c743.patch\n\n### References\nhttps://huntr.dev/bounties/1fa1cc3b-75ff-4d34-99ae-4a705eb623e","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 1.0.3"]}],"null_published_at":"2026-11-06T07:24:11.223Z","source_updated_at":"2024-02-22T05:32:34.098Z","source_disclosed_at":"2023-07-12T17:29:02.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:42:20.432Z"},{"id":"NVI-00007047","kind":"vulnerability","title":"Pimcore admin UI vulnerable to Cross-site Scripting in 2 factor authentication setup page","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-hqv9-6jqw-9g8m","CVE-2023-37280"],"plain_summary":"OSV carries this publisher advisory for pimcore/admin-ui-classic-bundle. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 1.0.3 for pimcore/admin-ui-classic-bundle. Confirm the publisher’s latest guidance.","source_ids":["sr-ccb4a8b4059464538e3325ac3f11dc6a"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-ccb4a8b4059464538e3325ac3f11dc6a","url":"https://github.com/advisories/GHSA-hqv9-6jqw-9g8m","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-hqv9-6jqw-9g8m","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:20.432Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-ccb4a8b4059464538e3325ac3f11dc6a"],"technology":"pimcore/admin-ui-classic-bundle","known_exclusions":[],"conditions_summary":"### Summary\n\nUnauthenticated HTML Injection / XSS Possible.\nConditions: 2factor authentication must not set before\n\n Vulnerable Endpoint: /admin/login/2fa-setup\n\n Vulnerable Param: error=\nHow it works, So basically any admin, who has not setup 2 factor authentication before is vulnerable for this attack, without need for any form of privilege, causing the application to execute arbitrary scripts / HTML Contents.\n\nAnother potential attack vector, as it's a 2fa page and it has QR Code, attacker can replace this QR Code with something he has, leading to increase threat to the admin.\n\nThis attack can be used to execute arbitrary scripts or HTML Injection, causing the target application to execute these resulting in cookie steeling, defacement or Injecting phishing URLs on the target application.\n\n### Patches\nUpdate to version 1.0.3 or apply this patches manually\nhttps://github.com/pimcore/admin-ui-classic-bundle/commit/5fcd19bdc89a3fe4cb8ad8c356590e1e4740c743.patch\n\n### Workarounds\nApply patches manually: https://github.com/pimcore/admin-ui-classic-bundle/commit/5fcd19bdc89a3fe4cb8ad8c356590e1e4740c743.patch\n\n### References\nhttps://huntr.dev/bounties/1fa1cc3b-75ff-4d34-99ae-4a705eb623e","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 1.0.3"]}],"null_published_at":"2026-10-31T22:13:14.309Z","source_updated_at":"2024-02-22T05:32:34.098Z","source_disclosed_at":"2023-07-12T17:29:02.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:20.432Z"}],"next_cursor":null,"snapshot_revision":"42594"}