PT-2025-5999 · Pimcore · Pimcore Admin Classic Bundle

Ayman-Rayan · Published 2025-02-07 · Updated 2025-11-04 · CVE-2025-24980

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions pimcore/admin-ui-classic-bundle versions prior to 1.7.4

Description The issue concerns an error message in the "Forgot password" function that discloses existing accounts, leading to user enumeration on the target. This allows attackers to identify valid usernames, potentially facilitating further attacks.

Recommendations For versions prior to 1.7.4, upgrade to version 1.7.4 to address the issue. As a temporary workaround, consider restricting access to the "Forgot password" function until the upgrade is applied.

Exploit

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2025-24980

GHSA-VR5F-PHP7-RG24

Affected Products

Pimcore Admin Classic Bundle

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24980.json · Exploit
• 🔥 https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-vr5f-php7-rg24 · Exploit
• https://osv.dev/vulnerability/CVE-2025-24980 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vr5f-php7-rg24 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24980 · Security Note
• https://github.com/pimcore/admin-ui-classic-bundle/pull/808 · Note
• https://github.com/pimcore/admin-ui-classic-bundle/commit/96ae555578c3b4df368092d71e07a6c4ddf8fbe9 · Note
• https://github.com/pimcore/admin-ui-classic-bundle · Note
• https://t.me/cveNotify/141703 · Telegram Post
• https://t.me/cvedetector/17516 · Telegram Post
• https://twitter.com/CVEnew/status/1887958293257073090 · Twitter Post