{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-17T07:42:58.103","vulnerabilities":[{"cve":{"id":"CVE-2023-42817","sourceIdentifier":"security-advisories@github.com","published":"2023-09-25T19:15:10.493","lastModified":"2024-11-21T08:23:16.510","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user. The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box. This issue has been patched in commit `abd77392` which is included in release 1.1.2. Users are advised to update to version 1.1.2 or apply the patch manually.\n"},{"lang":"es","value":"Pimcore admin-ui-classic-bundle proporciona una interfaz de usuario de backend para Pimcore. El valor de traducción con texto que incluye “%s” (de “%suggest%) es analizado por sprintf() aunque se supone que debe enviarse literalmente al usuario. Las traducciones pueden ser accesibles para un usuario con un acceso general comparativamente menor (ya que el permiso de traducción no puede limitarse a ciertos \"módulos\") y un atacante experto podría explotar el análisis de la cadena de traducción en el cuadro de diálogo. Este problema se solucionó en el commit \"abd77392\" que se incluye en la versión 1.1.2. Se recomienda a los usuarios que actualicen a la versión 1.1.2 o apliquen el parche manualmente."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pimcore:admin_classic_bundle:*:*:*:*:*:pimcore:*:*","versionEndExcluding":"1.1.2","matchCriteriaId":"60E1D658-E228-45EC-9B34-0DA4F469A1AC"}]}]}],"references":[{"url":"https://github.com/pimcore/admin-ui-classic-bundle/commit/abd7739298f974319e3cac3fd4fcd7f995b63e4c","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-m988-7375-7g2c","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/pimcore/admin-ui-classic-bundle/commit/abd7739298f974319e3cac3fd4fcd7f995b63e4c","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-m988-7375-7g2c","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}