CVE-2022-0955: 
PHP vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was identified in Pimcore Data Hub, tracked as CVE-2022-0955. The vulnerability was discovered in early 2022 and was related to insufficient sanitization of user input in the ConfigController.php file (GitHub Commit).

The vulnerability existed in the ConfigController.php file where the 'text' parameter was not properly sanitized before being rendered. The issue was specifically located in the buildItem function where the $name variable was directly assigned to the 'text' field without proper HTML encoding (GitHub Commit). The vulnerability was classified as CWE-79, which is associated with Cross-Site Scripting (NVD Report).

The Cross-Site Scripting vulnerability could potentially allow attackers to inject malicious scripts that would execute in the context of other users' browsers, potentially leading to theft of sensitive information or session hijacking.

The vulnerability was patched by implementing proper input sanitization using PHP's htmlspecialchars() function on the $name variable before assigning it to the 'text' field (GitHub Commit).