CVE-2024-41109: falha de média gravidade em pimcore admin-ui-classic-bundle
Pimcore vulnerable to disclosure of system and database information behind /admin firewall
Publicada em · Atualizada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.3epss 0.5%
probabilidade de exploração
0.5%top 60% das CVEs
exploração observada
nãonenhuma fonte reporta
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
pimcore · admin-ui-classic-bundleCVEs relacionadas — pimcore admin-ui-classic-bundle
No mesmo produto, das mais perigosas para as menos.
CVE-2023-49075HIGHPimcore Admin UI has Two Factor Authentication disabled for non admin security firewallsEPSS 1.4%CVE-2024-23646HIGHPimcore Admin Classic Bundle SQL Injection in Admin download files as zipEPSS 1.0%CVE-2024-23648HIGHPimcore Admin Classic Bundle host header injection in the password resetEPSS 0.8%CVE-2024-25625HIGHPimcore Host Header Injection in user invitation linkEPSS 0.7%CVE-2023-47636MEDIUMFull Path Disclosure via re-export document in pimcore/admin-ui-classic-bundleEPSS 0.7%CVE-2023-37280MEDIUMPimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup pageEPSS 0.6%
Referências
https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36