CVE-2023-42817
Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translations
Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user. The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box. This issue has been patched in commit abd77392 which is included in release 1.1.2. Users are advised to update to version 1.1.2 or apply the patch manually.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translations
Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user. The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box. This issue has been patched in commit abd77392 which is included in release 1.1.2. Users are advised to update to version 1.1.2 or apply the patch manually.
- Record
CVE-2023-42817- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2023-2548
Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user. The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box. This issue has been patched in commit abd77392 which is included in release 1.1.2. Users are advised to update to version 1.1.2 or apply the patch manually.
- Record
EUVD-2023-2548- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m988-7375-7g2c
pimcore/admin-ui-classic-bundle Cross-site Scripting vulnerability in Translations
Impact
The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user.
The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box.
Patches
Workarounds
Update to version 1.1.2 or apply this patches manually https://github.com/pimcore/admin-ui-classic-bundle/commit/abd7739298f974319e3cac3fd4fcd7f995b63e4c.patch
- Record
GHSA-m988-7375-7g2c- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user. The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box. This issue has been patched in commit abd77392 which is included in release 1.1.2. Users are advised to update to version 1.1.2 or apply the patch manually.
- Record
CVE-2023-42817- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translations
Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user. The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box. This issue has been patched in commit abd77392 which is included in release 1.1.2. Users are advised to update to version 1.1.2 or apply the patch manually.
- Record
CVE-2023-42817- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-m988-7375-7g2c
pimcore/admin-ui-classic-bundle Cross-site Scripting vulnerability in Translations
Impact
The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user.
The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box.
Patches
Workarounds
Update to version 1.1.2 or apply this patches manually https://github.com/pimcore/admin-ui-classic-bundle/commit/abd7739298f974319e3cac3fd4fcd7f995b63e4c.patch
- Record
GHSA-m988-7375-7g2c- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pimcore/admin-ui-classic-bundlePackagist |
before 1.1.2 | 1.1.2 |
pimcore/admin-ui-classic-bundlePackagist |
before 1.1.2, plus listed versions v1.0.0v1.0.0-BETA1v1.0.0-RC1v1.0.0-RC2v1.0.1 Show 8 moreShow lessv1.0.2v1.0.3v1.0.4v1.0.5v1.0.6v1.1.0v1.1.0-RC1v1.1.1 |
1.1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-42817 is a medium vulnerability (CVSS 5.4) in Pimcore Admin-ui-classic-bundle, published September 25, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in pimcore/admin-ui-classic-bundle 1.1.2.
References
github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-m988-7375-7g2c
nvd.nist.gov/vuln/detail/CVE-2023-42817