PT-2022-13079 · Pimcore · Pimcore

Published 2022-01-18 · Updated 2022-01-24 · CVE-2022-0263

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pimcore/pimcore versions prior to 10.2.7

Description The issue is related to the unrestricted upload of files with dangerous types. This could potentially lead to security risks. The estimated number of affected devices and real-world incidents are not specified.

Recommendations For versions prior to 10.2.7, update to version 10.2.7 or later to resolve the issue. As a temporary workaround, consider restricting file uploads to only allow safe file types until a patch is applied. Restrict access to the file upload feature to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-0263

GHSA-C697-R227-PQ6H

Affected Products

Pimcore

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0263.json · Exploit
• 🔥 https://huntr.dev/bounties/96506857-06bc-4c84-88b7-4f397715bcf6 · Exploit
• https://github.com/pimcore/pimcore/commit/35d1853baf64d6a1d90fd8803e52439da53a3911 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-0263 · Security Note
• https://osv.dev/vulnerability/GHSA-c697-r227-pq6h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0263 · Vendor Advisory
• https://github.com/pimcore/pimcore · Note
• https://t.me/cibsecurity/35710 · Telegram Post