CVE-2024-32871 Pimcore Vulnerable to Flooding Server with Thumbnail files

2024-06-0414:43:20

CWE-770

GitHub_M

www.cve.org

cve-2024-32871

pimcore

vulnerable

server flooding

thumbnail files

open source

data & experience management

platform

fixed

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

23.7%

JSON

Pimcore is an Open Source Data & Experience Management Platform. The Pimcore thumbnail generation can be used to flood the server with large files. By changing the file extension or scaling factor of the requested thumbnail, attackers can create files that are much larger in file size than the original. This vulnerability is fixed in 11.2.4.

CNA Affected

[
  {
    "vendor": "pimcore",
    "product": "pimcore",
    "versions": [
      {
        "version": ">= 11.0.0, < 11.2.4",
        "status": "affected"
      }
    ]
  }
]