Vulnerability · Published Feb 18, 2021 · Assigned by snyk

CVE-2021-23340Local File Inclusion

High 7.1

In plain English

A high-severity security flaw in pimcore/pimcore. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)1.3%top 29.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename]. Since exportFile variable is not sanitized, an attacker can exploit a local file inclusion vulnerability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	pimcore/pimcore	6.8.8	GHSA-h7f9-cvh5-qw7f

Affected products (as reported)

Vendor	Product	Versions
n/a	pimcore/pimcore	unspecified – before 6.8.8

References

https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-1070132 x_refsource_MISC
https://github.com/pimcore/pimcore/blob/v6.7.2/bundles/AdminBundle/Controller/Reports/CustomReportController.php%23L454 x_refsource_MISC
https://github.com/pimcore/pimcore/commit/1786bdd4962ee51544fad537352c2b4223309442 x_refsource_MISC