CVE-2023-28850

Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Version 1.5.1 has a patch. As a workaround, one may apply the patch manually.

• CWE-79

• https://github.com/pimcore/perspective-editor/pull/121.patchMailing List, Patch
• https://github.com/pimcore/perspective-editor/security/advisories/GHSA-fq8q-55v3-2986Exploit, Patch, Vendor Advisory
• https://huntr.dev/bounties/5529f51e-e40f-46f1-887b-c9dbebab4f06/Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/pimcore/perspective-editor/pull/121.patchMailing List, Patch
• https://github.com/pimcore/perspective-editor/security/advisories/GHSA-fq8q-55v3-2986Exploit, Patch, Vendor Advisory
• https://huntr.dev/bounties/5529f51e-e40f-46f1-887b-c9dbebab4f06/Exploit, Issue Tracking, Patch, Third Party Advisory

Published

Apr 3, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28845Nextcloud talk is a video & audio conferencing app for Nextc…3.5
• CVE-2023-28846Unpoly is a JavaScript framework for server-side web applica…7.5
• CVE-2023-28847Nextcloud Server is the file server software for Nextcloud, …7.5
• CVE-2023-28848user_oidc is the OIDC connect user backend for Nextcloud, an…5.4
• CVE-2023-28849GLPI is a free asset and IT management software package. Sta…5.4
• CVE-2023-2885Improper Enforcement of Message Integrity During Transmissio…8.1
• CVE-2023-28851Silverstripe Form Capture provides a method to capture simpl…5.4
• CVE-2023-28852GLPI is a free asset and IT management software package. Sta…4.8
• CVE-2023-28853Mastodon is a free, open-source social network server based …6.5
• CVE-2023-28854nophp is a PHP web framework. Prior to version 0.0.1, nophp …8.8
• CVE-2023-28855Fields is a GLPI plugin that allows users to add custom fiel…6.5
• CVE-2023-28856Redis is an open source, in-memory database that persists on…6.5