6.5

CVE-2024-41109

Exploit

Pimcore vulnerable to disclosure of system and database information behind /admin firewall

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system.  This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Pimcore ≫ Admin Classic Bundle SwPlatformpimcore Version < 1.3.10
Pimcore ≫ Admin Classic Bundle SwPlatformpimcore Version >= 1.4.0 < 1.4.6
Pimcore ≫ Admin Classic Bundle SwPlatformpimcore Version >= 1.5.0 < 1.5.2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.48% 0.377
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
security-advisories@github.com 6.3 2.8 3.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40
Product
https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0
Patch
https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2
Release Notes
https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36
Vendor Advisory
Exploit