CVE-2023-4145
Cross-site Scripting (XSS) - Stored in pimcore/customer-data-framework
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Cross-site Scripting (XSS) - Stored in pimcore/customer-data-framework
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2.
- Record
CVE-2023-4145- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2023-2229
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2.
- Record
EUVD-2023-2229- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-735f-w79p-282x
pimcore/customer-management-framework-bundle Cross-site Scripting vulnerability in Segment name
Impact
As HTML injection works in email an attacker can trick a victim to click on such hyperlinks to redirect him to any malicious site and also can host a XSS page. All this will surely cause some damage to the victim. This could lead to users being tricked into giving logins away to malicious attackers.
Patches
Update to version 3.4.2 or apply this patch manually https://github.com/pimcore/customer-data-framework/commit/72f45dd537a706954e7a71c99fbe318640e846a2.patch
Workarounds
Apply https://github.com/pimcore/customer-data-framework/commit/72f45dd537a706954e7a71c99fbe318640e846a2.patch manually.
References
https://huntr.dev/bounties/ce852777-2994-40b4-bb4e-c4d10023eeb0/
- Record
GHSA-735f-w79p-282x- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-79, CWE-87
- Updated
- 2026-11-02
NVD
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2.
- Record
CVE-2023-4145- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Cross-site Scripting (XSS) - Stored in pimcore/customer-data-framework
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2.
- Record
CVE-2023-4145- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-735f-w79p-282x
pimcore/customer-management-framework-bundle Cross-site Scripting vulnerability in Segment name
Impact
As HTML injection works in email an attacker can trick a victim to click on such hyperlinks to redirect him to any malicious site and also can host a XSS page. All this will surely cause some damage to the victim. This could lead to users being tricked into giving logins away to malicious attackers.
Patches
Update to version 3.4.2 or apply this patch manually https://github.com/pimcore/customer-data-framework/commit/72f45dd537a706954e7a71c99fbe318640e846a2.patch
Workarounds
Apply https://github.com/pimcore/customer-data-framework/commit/72f45dd537a706954e7a71c99fbe318640e846a2.patch manually.
References
https://huntr.dev/bounties/ce852777-2994-40b4-bb4e-c4d10023eeb0/
- Record
GHSA-735f-w79p-282x- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-79, CWE-87
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pimcore/customer-management-framework-bundlePackagist |
before 3.4.2 | 3.4.2 |
pimcore/customer-management-framework-bundlePackagist |
before 3.4.2, plus listed versions 1.3.172.4.5v1.0.0v1.0.1v1.1.0 Show 45 moreShow lessv1.1.1v1.10.0v1.10.1v1.11.0v1.12.0v1.12.1v1.13.0v1.13.1v1.14.0v1.14.1v1.14.2v1.14.3v1.14.4v1.2.0v1.2.1v1.2.2v1.2.3v1.2.4v1.2.5v1.2.6v1.3.0v1.3.1v1.3.10v1.3.11v1.3.12v1.3.13v1.3.14v1.3.15v1.3.16v1.3.18v1.3.19v1.3.2v1.3.20v1.3.21v1.3.3v1.3.4v1.3.5v1.3.6v1.3.7v1.3.8v1.3.9v1.4.0v1.4.1v1.4.10v1.4.11 |
3.4.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-4145 is a medium vulnerability (CVSS 6.5) in Pimcore Customer-data-framework, published August 3, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in pimcore/customer-management-framework-bundle 3.4.2.
References
huntr.dev/bounties/ce852777-2994-40b4-bb4e-c4d10023eeb0
github.com/pimcore/customer-data-framework/commit/72f45dd537a706954e7a71c99fbe318640e846a2
nvd.nist.gov/vuln/detail/CVE-2023-4145
Left out here: 92 versions. The JSON record has them.