GitHub Advisoryadvisory · Packagist

GHSA-6f58-j323-6472 pimcore/admin-ui-classic-bundle Unverified Password Change

MEDIUM Published 2023-10-31 Modified 2025-11-10 Official page ↗
Aliases
CVE-2023-5844
Ecosystem
Packagist
Packages
pimcore/admin-ui-classic-bundle
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-287, CWE-620
Reviewed
2023-10-31

Affected packages

• Packagist pimcore/admin-ui-classic-bundle: < 1.2.0-RC1 → fixed in 1.2.0-RC1

Description

Impact As old password can be set as new password , it is considered as password policy violation. Pimcore is not enforcing strict password policy which allow attacker to set old password as new password Proof of Concept 1. Go to Admin link 2. login and click on -> "User | My Profile". 3. Go to change password now put old password as new password and click save. Patches https://github.com/pimcore/admin-ui-classic-bundle/commit/498ac77e54541177be27b0c710e387c47b3836ea.patch Workarounds Update to version 1.2.0 or apply this patches manually https://github.com/pimcore/admin-ui-classic-bundle/commit/498ac77e54541177be27b0c710e387c47b3836ea.patch References https://huntr.com/bounties/b031199d-192a-46e5-8c02-f7284ad74021/

Related

Alias · CVE (1)

  • CVE-2023-5844 Unverified Password Change in GitHub repository pimcore/admin-ui-classic-bundle prior to 1.2.0. vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-620 Unverified Password Change weakness

References