GitHub Advisoryadvisory · Packagist
GHSA-42c3-wvww-gcqj Pimcore Remote Code Execution vulnerability in Search function
MEDIUM
Official page ↗
- Aliases
- CVE-2023-1578
- Ecosystem
- Packagist
- Packages
- pimcore/pimcore
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-89
- Reviewed
- 2023-03-22
Affected packages
• Packagist pimcore/pimcore: < 10.5.19 → fixed in 10.5.19
Description
Impact
Attacker can get full DB and maybe RCE knowing the WEBROOT path
Patches
Update to version 10.5.19 or apply this patch manually https://github.com/pimcore/pimcore/commit/367b74488808d71ec3f66f4ca9e8df5217c2c8d2.patch
Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/367b74488808d71ec3f66f4ca9e8df5217c2c8d2.patch manually.
References
14538
Related
Alias · CVE (1)
- CVE-2023-1578 SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19. vulnerability
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- https://github.com/pimcore/pimcore/security/advisories/GHSA-42c3-wvww-gcqj web
- https://nvd.nist.gov/vuln/detail/CVE-2023-1578 advisory
- https://github.com/pimcore/pimcore/pull/14538 web
- https://github.com/pimcore/pimcore/commit/367b74488808d71ec3f66f4ca9e8df5217c2c8d2 web
- https://github.com/pimcore/pimcore package
- https://huntr.dev/bounties/7e441a14-8e55-4ab4-932c-4dc56bb1bc2e web