CVE-2023-28438 Pimcore vulnerable to improper quoting of filters in Custom Reports

2023-03-2220:46:33

CWE-89

GitHub_M

www.cve.org

pimcore

vulnerability

custom reports

filtering

sql injection

patch

upgrade

CVSS3

6.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

EPSS

0.001

Percentile

51.0%

JSON

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with ‘report’ permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually.

CNA Affected

[
  {
    "vendor": "pimcore",
    "product": "pimcore",
    "versions": [
      {
        "version": "< 10.5.19",
        "status": "affected"
      }
    ]
  }
]