PT-2014-4958 · Zend+1 · Zend Http Response Stream+1

Publicado 2014-04-21 · Atualizado 2014-04-22 · CVE-2014-2922

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions pimcore versions 1.4.9 through 2.1.0

Description The issue concerns the getObjectByToken function in Newsletter.php within the Pimcore Tool Newsletter module. It fails to properly handle an object obtained by unserializing a pathname, allowing remote attackers to conduct PHP object injection attacks. This can lead to the deletion of arbitrary files via vectors involving a Zend Http Response Stream object.

Recommendations For pimcore versions 1.4.9 through 2.1.0, consider disabling the getObjectByToken function in Newsletter.php until a patch is available to prevent PHP object injection attacks. Restrict access to the Pimcore Tool Newsletter module to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-2922

Produtos afetados

Zend Http Response Stream

Pimcore

Referências · 6

• 🔥 https://github.com/pedrib/PoC/blob/master/pimcore-2.1.0.txt · Exploit
• 🔥 https://exploit-db.com/exploits/43886 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2922 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2922 · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/04/21/1 · Nota
• http://pimcore.org/en/resources/blog/pimcore+2.2+released_b442 · Aviso do Fabricante