PT-2020-19772 · Pimcore · Pimcore

Daniele Scanu · Published 2020-10-30 · Updated 2021-05-06 · CVE-2020-7759

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pimcore/pimcore versions 6.7.2 through 6.8.3

Description The issue affects the data classification functionality in ClassificationstoreController, allowing for SQL Injection. This can be exploited by sending a specifically-crafted input in the relationIds parameter. For example, a request to "/admin/classificationstore/relations" with a manipulated relationIds parameter can demonstrate this exploit.

Recommendations For versions 6.7.2 through 6.8.3, as a temporary workaround, consider restricting access to the ClassificationstoreController or disabling the relationIds parameter in the "/admin/classificationstore/relations" endpoint until a patch is available. Avoid using the relationIds parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-7759

GHSA-8JMH-C6VR-PMVM

SNYK-PHP-PIMCOREPIMCORE-1017405

Affected Products

Pimcore

References · 5

• https://github.com/pimcore/pimcore/pull/7315 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-7759 · Security Note
• https://osv.dev/vulnerability/GHSA-8jmh-c6vr-pmvm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7759 · Vendor Advisory
• https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-1017405 · Note