Pimcore Admin Bundle Vulnerability

CVE-2024-41109

6.3MEDIUM

Key Information

Vendor: Pimcore
Status: Admin-ui-classic-bundle
Vendor: CVE Published:; 30 July 2024

Summary

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.

Affected Version(s)

admin-ui-classic-bundle = < 1.5.2

CVSS V3.1

Score:

6.3

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published.
Jul 30, 2024
Vulnerability Reserved.
Jul 15, 2024

Collectors

NVD DatabaseMitre Database