Allocation of Resources Without Limits or Throttling Affecting pimcore/pimcore package, versions >=11.0.0-ALPHA1, <11.2.4
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-PIMCOREPIMCORE-7210242
- published 5 Jun 2024
- disclosed 4 Jun 2024
- credit Johannes Heimbach, Daniel Torlop
Introduced: 4 Jun 2024
CVE-2024-32871 Open this link in a new tabHow to fix?
Upgrade pimcore/pimcore to version 11.2.4 or higher.
Overview
pimcore/pimcore is a content & product management framework (CMS/PIM/E-Commerce).
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the thumbnail generation process. An attacker can create disproportionately large files by manipulating the file extension or scaling factor of the requested thumbnail.
This vulnerability is caused by the following reasons:
All Imagick supported Fileformats are served without filtering;
Non Web optimized file formats (ORIGINAL, JPG, PNG) creates duplicated files on Server;
Scaling Factor is not limited and can be modified via url.