PT-2024-20588 · Pimcore · Pimcore Admin Classic Bundle

V32Y142Y · Published 2024-02-07 · Updated 2024-02-15 · CVE-2024-24822

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Pimcore's Admin Classic Bundle versions prior to 1.3.3

Description The issue allows an attacker to create, delete, etc., tags without having the permission to do so, due to a broken access control flaw. This can lead to the addition of dummy data and affect the integrity and availability of the system.

Recommendations For versions prior to 1.3.3, update to version 1.3.3 to resolve the issue. As a temporary workaround, one may apply the patch manually. Restrict access to tag creation and deletion functionality until the issue is resolved.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-24822

GHSA-3RFR-MPFJ-2JWQ

Affected Products

Pimcore Admin Classic Bundle

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24822.json · Exploit
• https://github.com/pimcore/admin-ui-classic-bundle/commit/24660b6d5ad9cbcb037a48d4309a6024e9adf251 · Patch
• https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-3rfr-mpfj-2jwq · Vendor Advisory
• https://github.com/pimcore/admin-ui-classic-bundle/pull/412 · Patch
• https://osv.dev/vulnerability/CVE-2024-24822 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24822 · Security Note
• https://osv.dev/vulnerability/GHSA-3rfr-mpfj-2jwq · Vendor Advisory
• https://github.com/pimcore/admin-ui-classic-bundle · Note
• https://twitter.com/v32y142y/status/1756417538626331105 · Twitter Post
• https://t.me/cvenotify/70471 · Telegram Post
• https://twitter.com/CVEnew/status/1755285224588742998 · Twitter Post
• https://t.me/cvenotify/71580 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1755313430251122853 · Twitter Post