GitHub Advisoryadvisory · Packagist

GHSA-c8hj-w239-5gvf pimcore/admin-ui-classic-bundle Full Path Disclosure via re-export document

MEDIUM Published 2023-11-15 Modified 2023-11-15 Official page ↗
Aliases
CVE-2023-47636
Ecosystem
Packagist
Packages
pimcore/admin-ui-classic-bundle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-209
Reviewed
2023-11-15

Affected packages

• Packagist pimcore/admin-ui-classic-bundle: < 1.2.1 → fixed in 1.2.1

Description

Impact Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the load_file() (within a SQL Injection) query to view the page source, require the attacker to have the full path to the file they wish to view. In the case of pimcore, the fopen() function here doesn't have an error handle when the file doesn't exist on the server so the server response raises the full path "fopen(/var/www/html/var/tmp/export-{ uniqe id}.csv)" Patches Apply patch https://github.com/pimcore/admin-ui-classic-bundle/commit/10d178ef771097604a256c1192b098af9ec57a87.patch Workarounds Update to version 1.2.1 or apply patches manually References https://huntr.com/bounties/4af4db18-9fd4-43e9-8bc6-c88aaf76839c/

Related

Alias · CVE (1)

  • CVE-2023-47636 The Pimcore Admin Classic Bundle provides a Backend UI for Pimcore. vulnerability

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References