CVE-2023-46722

The Pimcore Admin Classic Bundle provides a backend UI for Pimcore. Prior to version 1.2.0, a cross-site scripting vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 1.2.0 to receive a patch or, as a workaround, apply the patch manually.

• CWE-79
• CWE-80
• CWE-79

• https://github.com/pimcore/admin-ui-classic-bundle/commit/19fda2e86557c2ed4978316104de5ccdaa66d8b9Patch
• https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-jfxw-6c5v-c42fPatch, Vendor Advisory
• https://github.com/pimcore/pimcore/commit/757375677dc83a44c6c22f26d97452cc5cda5d7cPatch
• https://github.com/pimcore/admin-ui-classic-bundle/commit/19fda2e86557c2ed4978316104de5ccdaa66d8b9Patch
• https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-jfxw-6c5v-c42fPatch, Vendor Advisory
• https://github.com/pimcore/pimcore/commit/757375677dc83a44c6c22f26d97452cc5cda5d7cPatch

Published

Oct 31, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46717An improper authentication vulnerability [CWE-287] in FortiO…8.8
• CVE-2023-46718A stack-based buffer overflow in Fortinet FortiOS version 7.…7.8
• CVE-2023-46719Rejected reason: Not used
• CVE-2023-4672Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2023-46720A stack-based buffer overflow in Fortinet FortiOS version 7.…7.8
• CVE-2023-46721Rejected reason: Not used
• CVE-2023-46723lte-pic32-writer is a writer for PIC32 devices. In versions …7.5
• CVE-2023-46724Squid is a caching proxy for the Web. Due to an Improper Val…7.5
• CVE-2023-46725FoodCoopShop is open source software for food coops and loca…7.5
• CVE-2023-46726GLPI is a free asset and IT management software package. Sta…9.8
• CVE-2023-46727GLPI is a free asset and IT management software package. Sta…9.8
• CVE-2023-46728Squid is a caching proxy for the Web supporting HTTP, HTTPS,…7.5