CVE-2023-46722: 
PHP vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was discovered in Pimcore Admin Classic Bundle prior to version 1.2.0. The vulnerability, identified as CVE-2023-46722, was disclosed on October 31, 2023, and affects the backend UI of Pimcore (GitHub Advisory).

The vulnerability exists in the PDF preview functionality of the Pimcore Admin Classic Bundle. The issue occurs when handling PDF documents containing malicious JavaScript code, which could be executed during the preview process. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD).

The vulnerability could allow an attacker to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie. Additionally, it could enable attackers to redirect users to malicious sites (GitHub Advisory).

Users should upgrade to Pimcore Admin Classic Bundle version 1.2.0 or later which contains the security fix. Alternatively, users can manually apply the patches available at the provided GitHub commits. The fix implements PDF scanning functionality to detect and prevent the execution of unsafe JavaScript code in PDF previews (GitHub Advisory, Pimcore Patch).