CVE-2023-1701: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-29T16:15Z
Repository: https://github.com/pimcore/pimcore
Language: JavaScript
Files changed: bundles/AdminBundle/Resources/public/js/pimcore/settings/metadata/predefined.js, bundles/AdminBundle/Resources/public/js/pimcore/settings/properties/predefined.js
Commit date: 2023-03-27 15:46:41 +0200
Commit message: Security fix in Predefined section (#14721)

* Escape predefined property

* Escape predefined metadata
Diff: diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/settings/metadata/predefined.js b/bundles/AdminBundle/Resources/public/js/pimcore/settings/metadata/predefined.js
index 4f141f60cb12..a7e644ae987b 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/settings/metadata/predefined.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/settings/metadata/predefined.js
@@ -213,11 +213,13 @@ pimcore.settings.metadata.predefined = Class.create({
                         return klass;
                     },
                     tooltip: t('delete'),
                     handler: function (grid, rowIndex) {
                         let data = grid.getStore().getAt(rowIndex);
-                        pimcore.helpers.deleteConfirm(t('predefined_metadata'), data.data.name, function () {
+                        pimcore.helpers.deleteConfirm(t('predefined_metadata'),
+                            Ext.util.Format.htmlEncode(data.data.name),
+                            function () {
                             grid.getStore().removeAt(rowIndex);
                         }.bind(this));
                     }.bind(this)
                 }]
             },
diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/settings/properties/predefined.js b/bundles/AdminBundle/Resources/public/js/pimcore/settings/properties/predefined.js
index 0316ee055e66..2f91cd275470 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/settings/properties/predefined.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/settings/properties/predefined.js
@@ -163,11 +163,13 @@ pimcore.settings.properties.predefined = Class.create({
                       return klass;
                     },
                     tooltip: t('delete'),
                     handler: function (grid, rowIndex) {
                         let data = grid.getStore().getAt(rowIndex);
-                        pimcore.helpers.deleteConfirm(t('predefined_properties'), data.data.name, function () {
+                        pimcore.helpers.deleteConfirm(t('predefined_properties'),
+                            Ext.util.Format.htmlEncode(data.data.name),
+                            function () {
                             grid.getStore().removeAt(rowIndex);
                         }.bind(this));
                     }.bind(this)
                 }]
             },{

Vulnerable code:                         pimcore.helpers.deleteConfirm(t('predefined_metadata'), data.data.name, function () {
                        pimcore.helpers.deleteConfirm(t('predefined_properties'), data.data.name, function () {
Fixed code:                         pimcore.helpers.deleteConfirm(t('predefined_metadata'),
                            Ext.util.Format.htmlEncode(data.data.name),
                            function () {
                        pimcore.helpers.deleteConfirm(t('predefined_properties'),
                            Ext.util.Format.htmlEncode(data.data.name),
                            function () {