Pimcore Thumbnail Generation Vulnerability

CVE-2024-32871

What is CVE-2024-32871?

The Pimcore Data & Experience Management Platform has a vulnerability in its thumbnail generation functionality that can be exploited to flood the server with large files. By manipulating the file extension or the scaling factor of requested thumbnails, attackers can produce files that exceed the original file size significantly. This situation may lead to resource exhaustion on the server, potentially impacting the availability of the service. The issue has been addressed in version 11.2.4, emphasizing the importance of upgrading to mitigate this risk.

References