GitHub Advisoryadvisory · Packagist
GHSA-m4mv-rmr7-h5f5 Pimcore Privilege Defined With Unsafe Actions vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2023-2983
- Ecosystem
- Packagist
- Packages
- pimcore/pimcore
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-267
- Reviewed
- 2023-06-06
Affected packages
• Packagist pimcore/pimcore: < 10.5.23 → fixed in 10.5.23
Description
Impact
A new user can privilege escalation to admin role which least config
Patches
Update to version 10.5.23 or apply this patches manually
https://github.com/pimcore/pimcore/commit/c8f37b19c99cd82e4e558857d3e4d5476ea7228a.patch
Workarounds
Apply patches manually: https://github.com/pimcore/pimcore/commit/c8f37b19c99cd82e4e558857d3e4d5476ea7228a.patch
References
https://huntr.dev/bounties/6b2f33d3-2fd0-4d2d-ad7b-2c1e2417eeb1/
Related
Alias · CVE (1)
- CVE-2023-2983 Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23. vulnerability
Weakness · CWE (1)
- CWE-267 Privilege Defined With Unsafe Actions weakness
References
- https://github.com/pimcore/pimcore/security/advisories/GHSA-m4mv-rmr7-h5f5 web
- https://nvd.nist.gov/vuln/detail/CVE-2023-2983 advisory
- https://github.com/pimcore/pimcore/commit/c8f37b19c99cd82e4e558857d3e4d5476ea7228a web
- https://github.com/pimcore/pimcore package
- https://huntr.dev/bounties/6b2f33d3-2fd0-4d2d-ad7b-2c1e2417eeb1 web