CVE-2023-28850

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Version 1.5.1 has a patch. As a workaround, one may apply the patch manually.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
pimcore	perspective-editor	< 1.5.1

References

https://github.com/pimcore/perspective-editor/pull/121.patchMailing List, Patch
https://github.com/pimcore/perspective-editor/security/advisories/GHSA-fq8q-55v3-2986Exploit, Patch, Vendor Advisory
https://huntr.dev/bounties/5529f51e-e40f-46f1-887b-c9dbebab4f06/Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/pimcore/perspective-editor/pull/121.patchMailing List, Patch
https://github.com/pimcore/perspective-editor/security/advisories/GHSA-fq8q-55v3-2986Exploit, Patch, Vendor Advisory
https://huntr.dev/bounties/5529f51e-e40f-46f1-887b-c9dbebab4f06/Exploit, Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Apr 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-288515.4Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users. Starting in version 0.2.0 CVE-2023-288524.8GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 9.5.13 and 10.0.7, a user with dash CVE-2023-288536.5Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Startin CVE-2023-288548.8nophp is a PHP web framework. Prior to version 0.0.1, nophp is vulnerable to shell command injection on httpd user. A patch was made availab CVE-2023-288556.5Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access cont CVE-2023-288566.5Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an inval CVE-2023-288577.5Apereo CAS is an open source multilingual single sign-on solution for the web. Apereo CAS can be configured to use authentication based on c CVE-2023-288583.7redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to CVE-2023-288596.5redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can CVE-2023-28864.3Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation. This issue CVE-2023-288629.8An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling d CVE-2023-288639.1AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verification of Data Authenticity.