PT-2023-30526 · Pimcore · Pimcore Admin Classic Bundle

Xcapri · Published 2023-11-15 · Updated 2023-11-22 · CVE-2023-47636

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pimcore Admin Classic Bundle versions prior to 1.2.1

Description The issue allows an attacker to see the path to the webroot/file, which can be used in conjunction with other vulnerabilities, such as SQL Injection using the load file() query, to view the page source. In the case of Pimcore, the fopen() function does not have an error handle when the file does not exist on the server, causing the server response to reveal the full path, for example, "fopen(/var/www/html/var/tmp/export-{unique id}.csv)".

Recommendations For Pimcore Admin Classic Bundle versions prior to 1.2.1, upgrade to version 1.2.1 to resolve the issue. There are no known workarounds for this vulnerability.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2023-47636

GHSA-C8HJ-W239-5GVF

Affected Products

Pimcore Admin Classic Bundle

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47636.json · Exploit
• 🔥 https://huntr.com/bounties/4af4db18-9fd4-43e9-8bc6-c88aaf76839c · Exploit
• https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-c8hj-w239-5gvf · Vendor Advisory
• https://github.com/pimcore/admin-ui-classic-bundle/commit/10d178ef771097604a256c1192b098af9ec57a87 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-47636 · Security Note
• https://osv.dev/vulnerability/GHSA-c8hj-w239-5gvf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-47636 · Vendor Advisory
• https://github.com/pimcore/admin-ui-classic-bundle · Note