PT-2020-16374 · Pimcore · Pimcore

Brusch · Published 2020-12-03 · Updated 2020-12-03 · CVE-2020-26246

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 6.8.5

Description The issue allows modification and creation of website settings without appropriate permissions.

Recommendations For versions prior to 6.8.5, update to version 6.8.5 or later to resolve the issue.

Fix

Improper Authorization

Improper Preservation of Permissions

Weakness Enumeration

CWE-285

CWE-281

Related Identifiers

CVE-2020-26246

GHSA-7P8P-4253-3MG6

Affected Products

Pimcore

References · 7

• https://github.com/pimcore/pimcore/pull/7618 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-26246 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26246 · Vendor Advisory
• https://github.com/pimcore/pimcore/security/advisories/GHSA-7p8p-4253-3mg6 · Note
• https://t.me/cvenotify/6501 · Telegram Post
• https://t.me/cibsecurity/17069 · Telegram Post
• https://t.me/cvenotify/6508 · Telegram Post