Description

While testing the pimcore application, I found that it is vulnerable to XSS vulnerability in Predefined Asset Metadata module in Settings, specifically at Name field.

Proof of Concept

1.Go to https://11.x-dev.pimcore.fun/admin/ then login.
2.Go to Settings -> Predefined Asset Metadata and add a new definition.
3.Change the New Definition to the payload "><img src=x onerror=alert(document.domain);> at the Name field.
4.Click on delete icon (X) of that property, you will see the XSS popup triggers.

Impact

This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.