Information Exposure Affecting pimcore/pimcore package, versions <10.6.4
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-PIMCOREPIMCORE-5803011
- published 23 Jul 2023
- disclosed 21 Jul 2023
- credit Dalibor Karlović
Introduced: 21 Jul 2023
CVE-2023-3819 Open this link in a new tabHow to fix?
Upgrade pimcore/pimcore to version 10.6.4 or higher.
Overview
pimcore/pimcore is a content & product management framework (CMS/PIM/E-Commerce).
Affected versions of this package are vulnerable to Information Exposure which allows unauthorized users to obtain sensitive information about the system's runtime environment, features they have no permission to access, etc.
PoC
Create a new user without any permissions attached
Do not assign any permissions to the user
Do not add any locations to the user's workspace
Do not add it to any roles, etc
Log in as the said user
UI will be almost completely empty, but still several fetch requests in console are providing information the user shouldn't have access to.