PT-2023-31043 · Pimcore · Admin Classic Bundle

Published 2023-11-27 · Updated 2023-12-04 · CVE-2023-49075

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Admin Classic Bundle versions prior to 1.2.2

Description The issue concerns the AdminBundleSecurityPimcoreUserTwoFactorCondition class, which was introduced in version 11 and disables two-factor authentication for all non-admin security firewalls. As a result, an authenticated user can access the system without providing two-factor credentials.

Recommendations For versions prior to 1.2.2, upgrade to version 1.2.2 to resolve the issue. As a temporary workaround, consider applying the patch manually to disable the vulnerable condition until a formal update can be applied. Restrict access to sensitive areas of the system to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-308

Related Identifiers

CVE-2023-49075

GHSA-9WWG-R3C7-4VFG

Affected Products

Admin Classic Bundle

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49075.json · Exploit
• https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-9wwg-r3c7-4vfg · Vendor Advisory
• https://github.com/pimcore/admin-ui-classic-bundle/pull/345 · Vendor Advisory
• https://github.com/pimcore/admin-ui-classic-bundle/commit/e412b0597830ae564a604e2579eb40e76f7f0628 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-49075 · Security Note
• https://osv.dev/vulnerability/GHSA-9wwg-r3c7-4vfg · Vendor Advisory
• https://patch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49075 · Vendor Advisory
• https://github.com/pimcore/admin-ui-classic-bundle · Note
• https://t.me/cvenotify/62150 · Telegram Post
• https://t.me/cvenotify/61309 · Telegram Post