PT-2023-21204 · Pimcore · Pimcore/Customer-Data-Framework

Publicado 2023-05-17 · Atualizado 2023-05-25 · CVE-2023-2756

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pimcore/customer-data-framework versions prior to 3.3.10

Description The issue allows an administrator user to execute blind SQL queries using the inheritable segments feature. This can lead to the retrieval of sensitive data, modification of database information, or other malicious activities against the database.

Recommendations For versions prior to 3.3.10, update to version 3.3.10 to resolve the issue. As a temporary workaround, apply the patch manually from https://github.com/pimcore/customer-data-framework/commit/76df151737b7964ce5169fdf9e27a0ad801757fe.patch to mitigate the risk.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-2756

GHSA-25FX-3C2Q-CQ46

Produtos afetados

Pimcore/Customer-Data-Framework

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2756.json · Exploit
• 🔥 https://huntr.dev/bounties/cf398528-819f-456e-88e7-c06d268d3f44 · Exploit
• https://github.com/pimcore/customer-data-framework · Nota
• https://github.com/pimcore/customer-data-framework/commit/76df151737b7964ce5169fdf9e27a0ad801757fe · Correção
• https://github.com/pimcore/customer-data-framework/security/advisories/GHSA-25fx-3c2q-cq46 · Nota
• https://osv.dev/vulnerability/CVE-2023-2756 · Aviso do Fabricante
• https://t.me/cibsecurity/64307 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-2756 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-25fx-3c2q-cq46 · Aviso do Fabricante
• https://t.me/cvenotify/51151 · Publicação no Telegram