EUVD-2024-0339

Malicious code in bioql PyPI...

Improper Authorization

pimcore/ecommerce-framework-bundle is vulnerable to Improper Authorization. The vulnerability is due to a lack of permission enforcement within the admin/ecommerceframework/admin-order/list endpoint. An unauthorized user can access this endpoint without authorization, resulting in the ability to...

CVE-2024-21665: Improper Access Control

ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Access control and permissions are not being enforced. This vulnerability has been patched in...

PT-2024-19007 · Pimcore · Pimcore Ecommerce Framework Bundle

Name of the Vulnerable Software and Affected Versions: Pimcore Ecommerce Framework Bundle versions prior to 1.0.10 Description: The issue allows an authenticated and unauthorized user to access the back-office orders list and query over the information returned due to a lack of enforced access...