SQL Injection Affecting pimcore/pimcore package, versions <10.5.24
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.07% (32nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-PIMCOREPIMCORE-5777695
- published 16 Jul 2023
- disclosed 16 Jul 2023
- credit hiu240900
Introduced: 16 Jul 2023
CVE-2023-3673 Open this link in a new tabHow to fix?
Upgrade pimcore/pimcore to version 10.5.24 or higher.
Overview
pimcore/pimcore is a content & product management framework (CMS/PIM/E-Commerce).
Affected versions of this package are vulnerable to SQL Injection due to improper sanitization of concatenating strings passed into ORDER BY clause, in the 'sort' parameter.
References
CVSS Scores
version 3.1