CVE-2023-2323: 
PHP vulnerability analysis and mitigation

A stored Cross-site Scripting (XSS) vulnerability was identified in GitHub repository pimcore/pimcore versions prior to 10.5.21. The vulnerability was discovered and disclosed on April 27, 2023 (CVE Mitre).

The vulnerability is a stored Cross-site Scripting (XSS) issue that affects the name parameter of Pricing Rules in the Pimcore platform. The fix involved implementing proper HTML special character conversion using SecurityHelper::convertHtmlSpecialChars() for the name parameter (GitHub Commit).

The stored XSS vulnerability could allow attackers to inject malicious scripts that would be permanently stored on the target servers and executed in the browsers of users accessing the affected pages. This could lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected user's browser.

The vulnerability has been patched in Pimcore version 10.5.21. Users should upgrade to this version or later to protect against this security issue. The fix implements proper HTML special character encoding for the name parameter in Pricing Rules (GitHub Commit).