Timing attack

Affecting versions did not compare tokens in constant time, which could make it possible for an attacker to guess the 2fa token of a user. This has been fixed by using using the crate constanttimeeq for comparison...

Information Disclosure

pimcore/pimcore is vulnerable to information disclosure. The vulnerability exists through brute-force attacks for the 2FA token...

Design/Logic Flaw

Pimcore before 6.2.2 lacks brute force protection for the 2FA token...

CVE-2019-18985

Pimcore before 6.2.2 lacks brute force protection for the 2FA token...