CVE-2023-42817

Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user. The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box. This issue has been patched in commit `abd77392` which is included in release 1.1.2. Users are advised to update to version 1.1.2 or apply the patch manually.

• CWE-79

• https://github.com/pimcore/admin-ui-classic-bundle/commit/abd7739298f974319e3cac3fd4fcd7f995b63e4cPatch
• https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-m988-7375-7g2cThird Party Advisory
• https://github.com/pimcore/admin-ui-classic-bundle/commit/abd7739298f974319e3cac3fd4fcd7f995b63e4cPatch
• https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-m988-7375-7g2cThird Party Advisory

Published

Sep 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42811aes-gcm is a pure Rust implementation of the AES-GCM. Starti…5.5
• CVE-2023-42812Galaxy is an open-source platform for FAIR data analysis. Pr…4.3
• CVE-2023-42813Kyverno is a policy engine designed for Kubernetes. A securi…5.3
• CVE-2023-42814Kyverno is a policy engine designed for Kubernetes. A securi…5.3
• CVE-2023-42815Kyverno is a policy engine designed for Kubernetes. A securi…5.3
• CVE-2023-42816Kyverno is a policy engine designed for Kubernetes. A securi…5.3
• CVE-2023-42818JumpServer is an open source bastion host. When users enable…9.8
• CVE-2023-42819JumpServer is an open source bastion host. Logged-in users c…8.8
• CVE-2023-4282The EmbedPress plugin for WordPress is vulnerable to unautho…4.3
• CVE-2023-42820JumpServer is an open source bastion host. This vulnerabilit…8.2
• CVE-2023-42821The package `github.com/gomarkdown/markdown` is a Go library…7.5
• CVE-2023-42822xrdp is an open source remote desktop protocol server. Acces…6.5