PT-2024-19009 · Pimcore · Pimcore/Customer-Data-Framework

Wisconaut · Published 2024-01-10 · Updated 2024-01-18 · CVE-2024-21667

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions pimcore/customer-data-framework versions prior to 4.0.6

Description An authenticated and unauthorized user can access the GDPR data extraction feature and query over the information returned, leading to customer data exposure. Permissions are not enforced when reaching the "/admin/customermanagementframework/gdpr-data/search-data-objects" endpoint, allowing an authenticated user without the permissions to access the endpoint and query the data available there. An unauthorized user can access PII data from customers.

Recommendations For versions prior to 4.0.6, update to version 4.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/admin/customermanagementframework/gdpr-data/search-data-objects" endpoint until the update is applied. Additionally, review and enforce proper permissions for all users to prevent unauthorized access to customer data.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-21667

GHSA-G273-WPPX-82W4

Affected Products

Pimcore/Customer-Data-Framework

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21667.json · Exploit
• 🔥 https://github.com/pimcore/customer-data-framework/security/advisories/GHSA-g273-wppx-82w4 · Exploit
• https://github.com/pimcore/customer-data-framework/commit/6c34515be2ba39dceee7da07a1abf246309ccd77 · Patch
• https://osv.dev/vulnerability/CVE-2024-21667 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21667 · Security Note
• https://osv.dev/vulnerability/GHSA-g273-wppx-82w4 · Vendor Advisory
• https://github.com/pimcore/customer-data-framework/blob/b4af625ef327c58d05ef7cdf145fa749d2d4195e/src/Controller/Admin/GDPRDataController.php#L38 · Note
• https://github.com/pimcore/customer-data-framework · Note
• https://twitter.com/VulmonFeeds/status/1745336731576963344 · Twitter Post
• https://t.me/cvenotify/67831 · Telegram Post