Vulnerability: Cross-site Scripting pimcore pimcore version 10.3.0 and prior is vulnerable to cross-site scripting.
Vulnerability ID: GHSA-mxh3-2699-98g9
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/pimcore/pimcore
Published: 2022-02-09
File: bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php
Commit message: [Admin] DataObject - Escape class definitions group properly
Commit author: dpahuja

Vulnerable version (before fix):
 public function fieldcollectionTreeAction(Request $request, EventDispatcherInter                 if (!isset($groups[$item->getGroup()])) {                     $groups[$item->getGroup()] = [                         'id' => 'group_' . $item->getKey(),                         'text' => $item->getGroup(),                         'expandable' => true,                         'leaf' => false,                         'allowChildren' => true, public function objectbrickTreeAction(Request $request, EventDispatcherInterface                 if (!isset($groups[$item->getGroup()])) {                     $groups[$item->getGroup()] = [                         'id' => 'group_' . $item->getKey(),                         'text' => $item->getGroup(),                         'expandable' => true,                         'leaf' => false,                         'allowChildren' => true,

Fixed version (after fix):
 public function fieldcollectionTreeAction(Request $request, EventDispatcherInter                 if (!isset($groups[$item->getGroup()])) {                     $groups[$item->getGroup()] = [                         'id' => 'group_' . $item->getKey(),                         'text' => htmlspecialchars($item->getGroup()),                         'expandable' => true,                         'leaf' => false,                         'allowChildren' => true, public function objectbrickTreeAction(Request $request, EventDispatcherInterface                 if (!isset($groups[$item->getGroup()])) {                     $groups[$item->getGroup()] = [                         'id' => 'group_' . $item->getKey(),                         'text' => htmlspecialchars($item->getGroup()),                         'expandable' => true,                         'leaf' => false,                         'allowChildren' => true,

Patch:
patch: @@ -861,7 +861,7 @@ public function fieldcollectionTreeAction(Request $request, EventDispatcherInter
                 if (!isset($groups[$item->getGroup()])) {
                     $groups[$item->getGroup()] = [
                         'id' => 'group_' . $item->getKey(),
-                        'text' => $item->getGroup(),
+                        'text' => htmlspecialchars($item->getGroup()),
                         'expandable' => true,
                         'leaf' => false,
                         'allowChildren' => true,
@@ -1266,7 +1266,7 @@ public function objectbrickTreeAction(Request $request, EventDispatcherInterface
                 if (!isset($groups[$item->getGroup()])) {
                     $groups[$item->getGroup()] = [
                         'id' => 'group_' . $item->getKey(),
-                        'text' => $item->getGroup(),
+                        'text' => htmlspecialchars($item->getGroup()),
                         'expandable' => true,
                         'leaf' => false,
                         'allowChildren' => true,
path: bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php