CVE-2023-28429

Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 10.5.19 or, as a workaround, apply the patch manually.

• CWE-79

• https://github.com/pimcore/pimcore/pull/14574Patch
• https://github.com/pimcore/pimcore/pull/14574.patchPatch
• https://github.com/pimcore/pimcore/security/advisories/GHSA-rcg9-hrhx-6q69Patch, Vendor Advisory
• https://github.com/pimcore/pimcore/pull/14574Patch
• https://github.com/pimcore/pimcore/pull/14574.patchPatch
• https://github.com/pimcore/pimcore/security/advisories/GHSA-rcg9-hrhx-6q69Patch, Vendor Advisory

Published

Mar 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28423Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
• CVE-2023-28424Soko if the code that powers packages.gentoo.org. Prior to v…9.8
• CVE-2023-28425Redis is an in-memory database that persists on disk. Starti…5.5
• CVE-2023-28426Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-28427matrix-js-sdk is a Matrix messaging protocol Client-Server S…8.2
• CVE-2023-28428PDFio is a C library for reading and writing PDF files. In v…3.3
• CVE-2023-2843The MultiParcels Shipping For WooCommerce WordPress plugin b…8.8
• CVE-2023-28430OneSignal is an email, sms, push notification, and in-app me…8.1
• CVE-2023-28431Frontier is an Ethereum compatibility layer for Substrate. F…7.5
• CVE-2023-28432Minio is a Multi-Cloud Object Storage framework. In a cluste…7.5
• CVE-2023-28433Minio is a Multi-Cloud Object Storage framework. All users o…8.8
• CVE-2023-28434Minio is a Multi-Cloud Object Storage framework. Prior to RE…8.8