CVE-2024-32871

2024-06-0415:15:45

CWE-770

[email protected]

web.nvd.nist.gov

cve-2024-32871

security vulnerability

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

23.7%

JSON

Pimcore is an Open Source Data & Experience Management Platform. The Pimcore thumbnail generation can be used to flood the server with large files. By changing the file extension or scaling factor of the requested thumbnail, attackers can create files that are much larger in file size than the original. This vulnerability is fixed in 11.2.4.

Affected configurations

Vulners

NVD

Node

pimcorepimcoreRange11.0.0–11.2.4

CPENameOperatorVersion
pimcore:pimcorepimcorelt11.2.4

CPE	Name	Operator	Version
pimcore:pimcore	pimcore	lt	11.2.4

CNA Affected

[
  {
    "vendor": "pimcore",
    "product": "pimcore",
    "versions": [
      {
        "version": ">= 11.0.0, < 11.2.4",
        "status": "affected"
      }
    ]
  }
]