PT-2024-33488 · Pimcore · Pimcore

Blackbitdevs · Published 2024-10-23 · Updated 2024-11-06 · CVE-2024-49370

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pimcore portal engine versions prior to 4.1.7 Pimcore portal engine versions prior to 3.1.16

Description The issue affects Pimcore, an open source data and experience management platform. When a PortalUserObject is connected to a PimcoreUser and "Use Pimcore Backend Password" is set to true, the change password function in Portal Profile sets the new password without hashing it, allowing it to be read by everyone. This issue can affect everyone who combines PortalUser to PimcoreUsers and changes passwords via profile settings.

Recommendations For Pimcore portal engine versions prior to 4.1.7, update to version 4.1.7 to resolve the issue. For Pimcore portal engine versions prior to 3.1.16, update to version 3.1.16 to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-256

Related Identifiers

CVE-2024-49370

GHSA-74P5-77RQ-GFQC

Affected Products

Pimcore

References · 5

• 🔥 https://github.com/pimcore/pimcore/security/advisories/GHSA-74p5-77rq-gfqc · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49370.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-49370 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-49370 · Security Note
• https://t.me/cvedetector/8700 · Telegram Post