GitHub Advisoryadvisory · Packagist

GHSA-7hqr-j26m-gmwp Pimcore Unserialize Remote Code Execution

HIGH Published 2022-05-13 Modified 2024-04-24 Official page ↗
Aliases
CVE-2019-10867
Ecosystem
Packagist
Packages
pimcore/pimcore
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2024-04-24

Affected packages

• Packagist pimcore/pimcore: < 5.7.1 → fixed in 5.7.1

Description

An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to `/admin/class/bulk-commit`, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to `bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php`.

Related

Alias · CVE (1)

  • CVE-2019-10867 An issue was discovered in Pimcore before 5.7.1. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References