PT-2023-25293 · Pimcore · Pimcore/Customer-Data-Framework

Kingjia90 · Published 2023-07-10 · Updated 2023-07-19 · CVE-2023-3574

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions pimcore/customer-data-framework versions prior to 3.4.1

Description The product performs authorization checks incorrectly, allowing an unauthorized actor to access resources or perform actions. This enables the attacker to view and freely add, modify, or delete rules.

Recommendations For versions prior to 3.4.1, update to version 3.4.1 or apply the patch manually from https://github.com/pimcore/customer-data-framework/commit/f15668c86db254e86ba7ac895bc3cdd1a2a3cc45.patch.

Exploit

Fix

Improper Authorization

Incorrect Authorization

Weakness Enumeration

CWE-285

CWE-863

Related Identifiers

CVE-2023-3574

GHSA-VX35-F379-4Q49

Affected Products

Pimcore/Customer-Data-Framework

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3574.json · Exploit
• 🔥 https://huntr.dev/bounties/1dcb4f01-e668-4aa3-a6a3-838532e500c6 · Exploit
• https://github.com/pimcore/customer-data-framework/commit/f15668c86db254e86ba7ac895bc3cdd1a2a3cc45 · Patch
• https://osv.dev/vulnerability/GHSA-vx35-f379-4q49 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3574 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3574 · Vendor Advisory
• https://github.com/pimcore/customer-data-framework/commit/f15668c86db254e86ba7ac895bc3cdd1a2a3cc45.patch · Note
• https://github.com/pimcore/customer-data-framework/security/advisories/GHSA-vx35-f379-4q49 · Note
• https://github.com/pimcore/customer-data-framework · Note