Allocation of Resources Without Limits or Throttling Affecting pimcore/pimcore package, versions >=11.0.0-ALPHA1, <11.2.4


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.06% (26th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Allocation of Resources Without Limits or Throttling vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-PHP-PIMCOREPIMCORE-7210242
  • published5 Jun 2024
  • disclosed4 Jun 2024
  • creditJohannes Heimbach, Daniel Torlop

Introduced: 4 Jun 2024

CVE-2024-32871  (opens in a new tab)
CWE-770  (opens in a new tab)

How to fix?

Upgrade pimcore/pimcore to version 11.2.4 or higher.

Overview

pimcore/pimcore is a content & product management framework (CMS/PIM/E-Commerce).

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the thumbnail generation process. An attacker can create disproportionately large files by manipulating the file extension or scaling factor of the requested thumbnail.

This vulnerability is caused by the following reasons:

  1. All Imagick supported Fileformats are served without filtering;

  2. Non Web optimized file formats (ORIGINAL, JPG, PNG) creates duplicated files on Server;

  3. Scaling Factor is not limited and can be modified via url.

CVSS Scores

version 3.1