CVE-2024-23646

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The application allows users to create zip files from available files on the site. In the 1.x branch prior to version 1.3.2, parameter selectedIds is susceptible to SQL Injection. Any backend user with very basic...

Sql injection

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The application allows users to create zip files from available files on the site. In the 1.x branch prior to version 1.3.2, parameter selectedIds is susceptible to SQL Injection. Any backend user with very basic...

CVE-2024-23646

Pimcore Admin Classic Bundle (1.x) before 1.3.2 contains an SQL Injection in the selectedIds parameter used by the admin asset download flow (download-as-zip-add-files). Any backend user with basic permissions can execute arbitrary SQL and escalate to admin-level access. The fix is in 1.3.2. Affe...

CVE-2024-23646 Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The application allows users to create zip files from available files on the site. In the 1.x branch prior to version 1.3.2, parameter selectedIds is susceptible to SQL Injection. Any backend user with very basic...

CVE-2024-23648

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The password reset functionality sends to the the user requesting a password change an email containing an URL to reset its password. The URL sent contains a unique token, valid during 24 hours, allowing the user to res...

CVE-2024-23648 Pimcore Admin Classic Bundle host header injection in the password reset

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The password reset functionality sends to the the user requesting a password change an email containing an URL to reset its password. The URL sent contains a unique token, valid during 24 hours, allowing the user to res...

CVE-2024-23648

Summary (CVE-2024-23648) Pimcore Admin Classic Bundle is vulnerable to Host Header Injection in the password-reset flow. Before version 1.2.3, the reset URL was crafted using the request’s Host header, enabling an attacker-controlled domain to appear in the password-reset link sent by email. If a...

CVE-2024-23648 Pimcore Admin Classic Bundle host header injection in the password reset

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The password reset functionality sends to the the user requesting a password change an email containing an URL to reset its password. The URL sent contains a unique token, valid during 24 hours, allowing the user to res...

PT-2024-19999

Name of the Vulnerable Software and Affected Versions Pimcore's Admin Classic Bundle versions prior to 1.2.3 Description The password reset functionality in Pimcore's Admin Classic Bundle sends an email to the user requesting a password change with a URL containing a unique token, valid for 24...

CVE-2023-49075

The Admin Classic Bundle provides a Backend UI for Pimcore. AdminBundle\Security\PimcoreUserTwoFactorCondition introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without having to provide the two factor...

Design/Logic Flaw

The Admin Classic Bundle provides a Backend UI for Pimcore. AdminBundle\Security\PimcoreUserTwoFactorCondition introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without having to provide the two factor...

CVE-2023-49075

The CVE-2023-49075 issue affects Pimcore’s Admin Classic Bundle (AdminBundle) by introducing PimcoreUserTwoFactorCondition in v11 that disables two-factor authentication for all non-admin security firewalls. An authenticated user could access the system without completing 2FA. The vulnerability i...

CVE-2023-49075 Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls

The Admin Classic Bundle provides a Backend UI for Pimcore. AdminBundle\Security\PimcoreUserTwoFactorCondition introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without having to provide the two factor...

Pimcore Admin Classic Bundle Security Vulnerability

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce frameworks and product information management applications. A security vulnerability exists in Pimcore Adm...

CVE-2023-47636

The Pimcore Admin Classic Bundle provides a Backend UI for Pimcore. Full Path Disclosure FPD vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the loadfile within a SQL Injection query to view the page...

CVE-2023-47636 Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle

The Pimcore Admin Classic Bundle provides a Backend UI for Pimcore. Full Path Disclosure FPD vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the loadfile within a SQL Injection query to view the page...

CVE-2023-47636 Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle

The Pimcore Admin Classic Bundle provides a Backend UI for Pimcore. Full Path Disclosure FPD vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the loadfile within a SQL Injection query to view the page...

CVE-2023-47636

CVE-2023-47636 affects the Pimcore Admin Classic Bundle. The vulnerability is a Full Path Disclosure (FPD) in the Backend UI where loading a file path (for example via fopen) can reveal the server’s full path when the file does not exist, due to missing error handling. The issue has been patched ...

Pimcore Security Vulnerability

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce frameworks and product information management applications. A security vulnerability exists in Pimcore Adm...

PT-2023-30526 · Pimcore · Pimcore Admin Classic Bundle

Name of the Vulnerable Software and Affected Versions: Pimcore Admin Classic Bundle versions prior to 1.2.1 Description: The issue allows an attacker to see the path to the webroot/file, which can be used in conjunction with other vulnerabilities, such as SQL Injection using the load file query, ...