TI-2023-13356 Aliases CVE-2023-28850 GHSA-fq8q-55v3-2986

Pimcore Perspective Editor vulnerable to Cross-site Scripting in perspective name

LOW 28CWE-79Published 2023-04-03 · Updated 2025-02-11

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Version 1.5.1 has a patch. As a workaround, one may apply the patch manually.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00575 47th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Fixed perspective-editor (pimcore): 1.5.1pimcore/perspective-editor (Packagist): 1.5.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pimcore	perspective-editor	before 1.5.1	1.5.1	Patch available	CNA
—	pimcore/perspective-editor (Packagist)	before 1.5.1	1.5.1	Patch available	GHSA-fq8q-55v3-2986

perspective-editor Vendorpimcore Affected before 1.5.1 Fixed in 1.5.1 Patch available CNA
pimcore/perspective-editor (Packagist) Vendor— Affected before 1.5.1 Fixed in 1.5.1 Patch available GHSA-fq8q-55v3-2986

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pimcore:perspective_editor::::::::	before 1.5.1	Vulnerable	pimcore

cpe:2.3:a:pimcore:perspective_editor:*:*:*:*:*:*:*:* Versions before 1.5.1 Vulnerable ·pimcore

Remediation

Fix · CNA perspective-editor (pimcore) Fixed in 1.5.1
Fix · GHSA-fq8q-55v3-2986 pimcore/perspective-editor (Packagist) Fixed in 1.5.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-28850
2026-10-03 Alias added: GHSA-fq8q-55v3-2986

References

Exploit 2

Patch 1

https://github.com/pimcore/perspective-editor/pull/121.patch

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2023-28850

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences