PT-2023-21204 · Pimcore · Pimcore/Customer-Data-Framework

Published 2023-05-17 · Updated 2023-05-25 · CVE-2023-2756

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pimcore/customer-data-framework versions prior to 3.3.10

Description The issue allows an administrator user to execute blind SQL queries using the inheritable segments feature. This can lead to the retrieval of sensitive data, modification of database information, or other malicious activities against the database.

Recommendations For versions prior to 3.3.10, update to version 3.3.10 to resolve the issue. As a temporary workaround, apply the patch manually from https://github.com/pimcore/customer-data-framework/commit/76df151737b7964ce5169fdf9e27a0ad801757fe.patch to mitigate the risk.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-2756

GHSA-25FX-3C2Q-CQ46

Affected Products

Pimcore/Customer-Data-Framework

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2756.json · Exploit
• 🔥 https://huntr.dev/bounties/cf398528-819f-456e-88e7-c06d268d3f44 · Exploit
• https://github.com/pimcore/customer-data-framework/commit/76df151737b7964ce5169fdf9e27a0ad801757fe · Patch
• https://osv.dev/vulnerability/CVE-2023-2756 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2756 · Security Note
• https://osv.dev/vulnerability/GHSA-25fx-3c2q-cq46 · Vendor Advisory
• https://github.com/pimcore/customer-data-framework · Note
• https://github.com/pimcore/customer-data-framework/security/advisories/GHSA-25fx-3c2q-cq46 · Note
• https://t.me/cibsecurity/64307 · Telegram Post
• https://t.me/cvenotify/51151 · Telegram Post