CVE-2023-25240

Description

An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code.

How to fix CVE-2023-25240

To remediate CVE-2023-25240, upgrade the affected package to a fixed version below.

• Packagist/pimcore/pimcore—upgrade to 10.5.16 or later

Is CVE-2023-25240 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 10.5.16

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-25240
• PATCHgithub.com/pimcore/pimcore
• WEBgithub.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/pimcore/pimCore-10.5.15
• WEBportswigger.net/web-security/csrf/bypassing-samesite-restrictions