[pimcore/data-hub] Cross-site Scripting in Pimcore Datahub

Pimcore Datahub prior to 1.2.4 is vulnerable to stored cross-site scripting. An admin user accessing Datahub triggers the attack, which may result in the user’s cookie being stolen.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-0955
• https://github.com/pimcore/data-hub/commit/15d5b57af2466eebd3bbc531ead5dafa35d0a36e
• https://huntr.dev/bounties/708971a6-1e6c-4c51-a411-255caeba51df
• https://github.com/advisories/GHSA-vc5r-xfc4-4×22