PT-2023-4112 · Pimcore · Pimcore

Kingjia90 · Publicado 2023-07-21 · Atualizado 2023-07-26 · CVE-2023-3820

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions pimcore/pimcore versions prior to 10.6.4 pimcore/pimcore version 10.6.4 is not affected, the fixed version is 10.6.5

Description The issue is related to SQL injection in the pimcore/pimcore GitHub repository. This is due to a lack of protection measures for the SQL query structure. An attacker can exploit this issue to conduct SQL injection attacks remotely. Using SQL exploitation tools, such as sqlmap, an attacker can enumerate all information in the database, alter data, or perform a denial of service on the backend database.

Recommendations For pimcore/pimcore versions prior to 10.6.4, update to version 10.6.5 to resolve the issue. As a temporary workaround, apply the patch manually from https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97.patch to mitigate the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2023-04421

CVE-2023-3820

GHSA-C9HW-557Q-F8HQ

Produtos afetados

Pimcore

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3820.json · Exploit
• 🔥 https://huntr.dev/bounties/b00a38b6-d040-494d-bf46-38f46ac1a1db · Exploit
• https://github.com/pimcore/pimcore · Nota
• https://github.com/pimcore/pimcore/security/advisories/GHSA-c9hw-557q-f8hq · Nota
• https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97 · Correção
• https://t.me/cibsecurity/67098 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-3820 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-c9hw-557q-f8hq · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-04421 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-3820 · Aviso do Fabricante