PT-2023-25293 · Pimcore · Pimcore/Customer-Data-Framework

Kingjia90 · Publicado 2023-07-10 · Atualizado 2023-07-19 · CVE-2023-3574

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions pimcore/customer-data-framework versions prior to 3.4.1

Description The product performs authorization checks incorrectly, allowing an unauthorized actor to access resources or perform actions. This enables the attacker to view and freely add, modify, or delete rules.

Recommendations For versions prior to 3.4.1, update to version 3.4.1 or apply the patch manually from https://github.com/pimcore/customer-data-framework/commit/f15668c86db254e86ba7ac895bc3cdd1a2a3cc45.patch.

Exploit

Correção

Improper Authorization

Incorrect Authorization

Enumeração de Fraquezas

CWE-285

CWE-863

Identificadores relacionados

CVE-2023-3574

GHSA-VX35-F379-4Q49

Produtos afetados

Pimcore/Customer-Data-Framework

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3574.json · Exploit
• 🔥 https://huntr.dev/bounties/1dcb4f01-e668-4aa3-a6a3-838532e500c6 · Exploit
• https://github.com/pimcore/customer-data-framework/commit/f15668c86db254e86ba7ac895bc3cdd1a2a3cc45 · Correção
• https://github.com/pimcore/customer-data-framework/commit/f15668c86db254e86ba7ac895bc3cdd1a2a3cc45.patch · Nota
• https://github.com/pimcore/customer-data-framework/security/advisories/GHSA-vx35-f379-4q49 · Nota
• https://github.com/pimcore/customer-data-framework · Nota
• https://osv.dev/vulnerability/GHSA-vx35-f379-4q49 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-3574 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-3574 · Aviso do Fabricante