PT-2021-22445 · Pimcore · Pimcore

Brusch · Published 2021-09-15 · Updated 2021-09-27 · CVE-2021-39189

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 10.1.3

Description Pimcore is an open source data & experience management platform. In this platform, it is possible to enumerate usernames via the forgot password functionality.

Recommendations For versions prior to 10.1.3, update to version 10.1.3 or apply the available patch manually as a workaround.

Fix

Side Channel Attack

Weakness Enumeration

CWE-204

CWE-203

Related Identifiers

CVE-2021-39189

GHSA-579X-CJVR-CQJ9

Affected Products

Pimcore

References · 9

• https://github.com/pimcore/pimcore/pull/10223/commits/d0a4de39cf05dce6af71f8ca039132bdfcbb0dce · Patch
• https://github.com/pimcore/pimcore/pull/10223.patch · Patch
• https://osv.dev/vulnerability/CVE-2021-39189 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39189 · Security Note
• https://osv.dev/vulnerability/GHSA-579x-cjvr-cqj9 · Vendor Advisory
• https://github.com/pimcore/pimcore · Note
• https://github.com/pimcore/pimcore/security/advisories/GHSA-579x-cjvr-cqj9 · Note
• https://huntr.dev/bounties/12462a99-ebf8-4e39-80b3-54a16caa3f4c · Note
• https://t.me/cibsecurity/28898 · Telegram Post