CVE-2024-29197

2024-03-2615:15:49

CWE-200

[email protected]

web.nvd.nist.gov

cve-2024-29197

pimcore

data management

experience management

unpublished sites

session propagation

previews

vulnerability

11.2.2

11.1.6.1

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

6.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.9%

JSON

Pimcore is an Open Source Data & Experience Management Platform. Any call with the query argument ?pimcore_preview=true allows to view unpublished sites. In previous versions of Pimcore, session information would propagate to previews, so only a logged in user could open a preview. This no longer applies. Previews are broad open to any user and with just the hint of a restricted link one could gain access to possible confident / unreleased information. This vulnerability is fixed in 11.2.2 and 11.1.6.1.

Affected configurations

Vulners

Node

pimcorepimcoreRange11.0.0–11.1.6.1

pimcorepimcoreRange11.2.0–11.2.2

VendorProductVersionCPE
pimcorepimcore*cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*
pimcorepimcore*cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pimcore	pimcore	*	cpe:2.3:a:pimcore:pimcore::::::::
pimcore	pimcore	*	cpe:2.3:a:pimcore:pimcore::::::::

CNA Affected

[
  {
    "vendor": "pimcore",
    "product": "pimcore",
    "versions": [
      {
        "version": ">= 11.0.0, < 11.1.6.1",
        "status": "affected"
      },
      {
        "version": ">= 11.2.0, < 11.2.2",
        "status": "affected"
      }
    ]
  }
]