CVE-2022-3255

    Dashboard / Vulnerabilities / CVE-2022-3255

    CVE-2022-3255

    Published: 21 Sept 2022Last Modified: 12 Aug 2026

    Summary: Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

    Details: If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is able to view. Modify any information that the user is able to modify. Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.

    References: https://huntr.dev/bounties/0ea45cf9-b256-454c-9031-2435294c0902, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3255.json, https://nvd.nist.gov/vuln/detail/CVE-2022-3255, https://github.com/pimcore/pimcore/commit/1e916e7d668c9e47b217e20cc0ea4812f466201b

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -950f0a427a736c972314e81ee4b3870515d1244a

    Affected versions

    v10.5.6
    v10.5.5
    v10.5.4
    v10.5.3
    v10.5.2
    v10.5.1
    v10.5.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-3255 | CVE-DB