PT-2023-31044 · Pimcore · Pimcore/Customer-Data-Framework

Vesh3 · Published 2023-11-30 · Updated 2023-12-05 · CVE-2023-49076

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pimcore Customer-data-framework versions prior to 4.0.5

Description The issue allows an attacker to create new customers due to the lack of tokens or headers to prevent CSRF attacks. This can be exploited to manage customer data within Pimcore.

Recommendations For versions prior to 4.0.5, update to version 4.0.5 to resolve the issue. As a temporary workaround, consider implementing additional security measures to prevent CSRF attacks, such as validating requests through other means.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-49076

GHSA-XX63-4JR8-9GHC

Affected Products

Pimcore/Customer-Data-Framework

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49076.json · Exploit
• 🔥 https://github.com/pimcore/customer-data-framework/security/advisories/GHSA-xx63-4jr8-9ghc · Exploit
• https://github.com/pimcore/customer-data-framework/commit/ef7414415cfa64189b8433eff0aa2a9b537a89f7.patch · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49076 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49076 · Vendor Advisory
• https://t.me/cvenotify/62358 · Telegram Post
• https://t.me/cvenotify/61599 · Telegram Post