PT-2023-31043 · Pimcore · Admin Classic Bundle

Publicado 2023-11-27 · Atualizado 2023-12-04 · CVE-2023-49075

Positive Technologies (AI Summary)

CVSS v3.1

8.4

Alta

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Admin Classic Bundle versions prior to 1.2.2

Description The issue concerns the AdminBundleSecurityPimcoreUserTwoFactorCondition class, which was introduced in version 11 and disables two-factor authentication for all non-admin security firewalls. As a result, an authenticated user can access the system without providing two-factor credentials.

Recommendations For versions prior to 1.2.2, upgrade to version 1.2.2 to resolve the issue. As a temporary workaround, consider applying the patch manually to disable the vulnerable condition until a formal update can be applied. Restrict access to sensitive areas of the system to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-308

Identificadores relacionados

CVE-2023-49075

GHSA-9WWG-R3C7-4VFG

Produtos afetados

Admin Classic Bundle

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49075.json · Exploit
• https://github.com/pimcore/admin-ui-classic-bundle · Nota
• https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-9wwg-r3c7-4vfg · Aviso do Fabricante
• https://github.com/pimcore/admin-ui-classic-bundle/pull/345 · Aviso do Fabricante
• https://github.com/pimcore/admin-ui-classic-bundle/commit/e412b0597830ae564a604e2579eb40e76f7f0628 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-49075 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-9wwg-r3c7-4vfg · Aviso do Fabricante
• https://t.me/cvenotify/62150 · Publicação no Telegram
• https://patch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-49075 · Aviso do Fabricante
• https://t.me/cvenotify/61309 · Publicação no Telegram