CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
AI Score
Confidence
Low
EPSS
Percentile
22.7%
An authenticated and unauthorized user can access the GDPR data extraction feature and query over the information returned, leading to customer data exposure.
Permissions do not seem to be enforced when reaching the /admin/customermanagementframework/gdpr-data/search-data-objects
endpoint allowing an authenticated user without the permissions to access the endpoint and query the data available there. It seems that the access control is not enforced in this place : <https://github.com/pimcore/customer-data-framework/blob/b4af625ef327c58d05ef7cdf145fa749d2d4195e/src/Controller/Admin/GDPRDataController.php#L38>
In order to reproduce the issue, the following steps can be followed:
https://pimcore_instance/admin/customermanagementframework/gdpr-data/search-data-objects?id=&firstname=&lastname=&email=&page=1&start=0&limit=50
and the results will be returned to this unauthorized user.An unauthorized user can access PII data from customers without being authorized to.
Vendor | Product | Version | CPE |
---|---|---|---|
pimcore | customer_management_framework | * | cpe:2.3:a:pimcore:customer_management_framework:*:*:*:*:*:pimcore:*:* |
github.com/advisories/GHSA-g273-wppx-82w4
github.com/pimcore/customer-data-framework/blob/b4af625ef327c58d05ef7cdf145fa749d2d4195e/src/Controller/Admin/GDPRDataController.php#L38
github.com/pimcore/customer-data-framework/commit/6c34515be2ba39dceee7da07a1abf246309ccd77
github.com/pimcore/customer-data-framework/security/advisories/GHSA-g273-wppx-82w4
nvd.nist.gov/vuln/detail/CVE-2024-21667
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
AI Score
Confidence
Low
EPSS
Percentile
22.7%