Cloud Vulnerability DB
A community-led vulnerabilities database
Introducing Wiz for Exposure Management: Unify, prioritize, and remediate exposures everywhere.
Vulnerability DatabaseGHSA-jmh9-6rjq-gjh9
GHSA-jmh9-6rjq-gjh9:
PHP vulnerability analysis and mitigation
Overview
A moderate severity vulnerability was identified in PIMCore's admin-ui-classic-bundle affecting versions up to 1.4.2. The issue stems from the usage of jQuery version 3.4.1, which is known to be vulnerable to cross-site-scripting (XSS) attacks. The vulnerability was published on June 4, 2024, and reviewed by GitHub on June 5, 2024 (GitHub Advisory).
Technical details
The vulnerability exists in jQuery versions from 1.0.3 to versions before 3.5.0. The core issue involves the handling of HTML containing elements from untrusted sources. Even after sanitization, when such content is passed to jQuery's DOM manipulation methods (including .html(), .append(), and others), it may result in the execution of untrusted code (GitHub Advisory).
Impact
The vulnerability could potentially lead to cross-site scripting (XSS) attacks, allowing attackers to execute malicious code in the context of the user's browser when processing untrusted HTML content through jQuery's DOM manipulation methods (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been patched in pimcore/admin-ui-classic-bundle version 1.4.3. Users are advised to upgrade to this version or later to address the security issue. The underlying jQuery vulnerability was fixed in jQuery version 3.5.0 (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management