GitHub Advisoryadvisory · Packagist
GHSA-r87r-982q-2c3q Pimcore vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
HIGH
Official page ↗
- Aliases
- CVE-2023-3819
- Ecosystem
- Packagist
- Packages
- pimcore/pimcore
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
- Weaknesses
- CWE-200
- Reviewed
- 2023-07-21
Affected packages
• Packagist pimcore/pimcore: < 10.6.4 → fixed in 10.6.4
Description
Impact
Unauthorized users are able to obtain sensitive information about the system's runtime environment, features they have no permissions to access, etc.
Patches
Update to version 10.6.4 or apply this patch manually https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54.patch
Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54.patch manually.
References
https://huntr.dev/bounties/be5e4d4c-1b0b-4c01-a1fc-00533135817c/
Related
Alias · CVE (1)
- CVE-2023-3819 Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pimcore/pimcore prior to 10.6.4. vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://github.com/pimcore/pimcore/security/advisories/GHSA-r87r-982q-2c3q web
- https://nvd.nist.gov/vuln/detail/CVE-2023-3819 advisory
- https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54 web
- https://github.com/pimcore/pimcore package
- https://huntr.dev/bounties/be5e4d4c-1b0b-4c01-a1fc-00533135817c web