CVE-2023-47636: medium-severity vulnerability in pimcore admin-ui-classic-bundle
Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.7%
exploitation probability
0.7%top 50% of all CVEs
observed exploitation
nono source reports it
The Pimcore Admin Classic Bundle provides a Backend UI for Pimcore. Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the load_file() (within a SQL Injection) query to view the page source, require the attacker to have the full path to the file they wish to view. In the case of pimcore, the fopen() function here doesn't have an error handle when the file doesn't exist on the server so the server response raises the full path "fopen(/var/www/html/var/tmp/export-{ uniqe id}.csv)". This issue has been patched in commit `10d178ef771` which has been included in release version 1.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
pimcore · admin-ui-classic-bundleRelated CVEs — pimcore admin-ui-classic-bundle
In the same product, most dangerous first.
CVE-2023-49075HIGHPimcore Admin UI has Two Factor Authentication disabled for non admin security firewallsEPSS 1.4%CVE-2024-23646HIGHPimcore Admin Classic Bundle SQL Injection in Admin download files as zipEPSS 1.0%CVE-2024-23648HIGHPimcore Admin Classic Bundle host header injection in the password resetEPSS 0.8%CVE-2024-25625HIGHPimcore Host Header Injection in user invitation linkEPSS 0.7%CVE-2023-37280MEDIUMPimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup pageEPSS 0.6%CVE-2024-24822MEDIUMPimcore Admin Classic Bundle permissions are not getting checked when working with tagsEPSS 0.5%