Lucene search
GoogleOSV:CVE-2021-23340HistoryFeb 18, 2021 - 3:15 p.m.
CVE-2021-23340
2021-02-1815:15:14
Google
osv.dev
5
pimcore
local file inclusion
customreportcontroller
authenticated user
vulnerability
This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename]. Since exportFile variable is not sanitized, an attacker can exploit a local file inclusion vulnerability.
Related
cve
cve
CVE-2021-23340
2021-02-18 15:15:14
prion
prion
Arbitrary file deletion
2021-02-18 15:15:00
veracode
veracode
Local File Inclusion
2021-02-19 02:17:39
nvd
nvd
CVE-2021-23340
2021-02-18 15:15:14
cvelist
cvelist
CVE-2021-23340 Local File Inclusion
2021-02-18 14:25:14
osv
osv
Path traversal in pimcore/pimcore
2021-02-25 16:32:46
github
github
Path traversal in pimcore/pimcore
2021-02-25 16:32:46