PT-2023-31044 · Pimcore · Pimcore/Customer-Data-Framework

Vesh3 · Publicado 2023-11-30 · Atualizado 2023-12-05 · CVE-2023-49076

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pimcore Customer-data-framework versions prior to 4.0.5

Description The issue allows an attacker to create new customers due to the lack of tokens or headers to prevent CSRF attacks. This can be exploited to manage customer data within Pimcore.

Recommendations For versions prior to 4.0.5, update to version 4.0.5 to resolve the issue. As a temporary workaround, consider implementing additional security measures to prevent CSRF attacks, such as validating requests through other means.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-49076

GHSA-XX63-4JR8-9GHC

Produtos afetados

Pimcore/Customer-Data-Framework

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49076.json · Exploit
• 🔥 https://github.com/pimcore/customer-data-framework/security/advisories/GHSA-xx63-4jr8-9ghc · Exploit
• https://github.com/pimcore/customer-data-framework/commit/ef7414415cfa64189b8433eff0aa2a9b537a89f7.patch · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-49076 · Nota de Segurança
• https://t.me/cvenotify/62358 · Publicação no Telegram
• https://t.me/cvenotify/61599 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-49076 · Aviso do Fabricante