CVE-2024-23646highCWE-89

CVE-2024-23646: falha de alta gravidade em pimcore admin-ui-classic-bundle

Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip

Publicada em · Atualizada em

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 1.0%
probabilidade de exploração
1.0%top 38% das CVEs
exploração observada
nãonenhuma fonte reporta
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The application allows users to create zip files from available files on the site. In the 1.x branch prior to version 1.3.2, parameter `selectedIds` is susceptible to SQL Injection. Any backend user with very basic permissions can execute arbitrary SQL statements and thus alter any data or escalate their privileges to at least admin level. Version 1.3.2 contains a fix for this issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
pimcore · admin-ui-classic-bundle
CVEs relacionadas — pimcore admin-ui-classic-bundle

No mesmo produto, das mais perigosas para as menos.

CVE-2023-49075HIGHPimcore Admin UI has Two Factor Authentication disabled for non admin security firewallsEPSS 1.4%CVE-2024-23648HIGHPimcore Admin Classic Bundle host header injection in the password resetEPSS 0.8%CVE-2024-25625HIGHPimcore Host Header Injection in user invitation linkEPSS 0.7%CVE-2023-47636MEDIUMFull Path Disclosure via re-export document in pimcore/admin-ui-classic-bundleEPSS 0.7%CVE-2023-37280MEDIUMPimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup pageEPSS 0.6%CVE-2024-24822MEDIUMPimcore Admin Classic Bundle permissions are not getting checked when working with tagsEPSS 0.5%
Referências
https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/Asset/AssetController.php#L2006https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/Asset/AssetController.php#L2087https://github.com/pimcore/admin-ui-classic-bundle/commit/363afef29496cc40a8b863c2ca2338979fcf50a8https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.3.2https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-cwx6-4wmf-c6xv