Vulnerability · Published Mar 22, 2023 · Assigned by GitHub_M

CVE-2023-28438Pimcore vulnerable to improper quoting of filters in Custom Reports

Medium 6.2

In plain English

A medium-severity SQL injection in pimcore from pimcore. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.2Medium

Exploit odds (30 days)0.9%top 41.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	pimcore/pimcore	10.5.19	GHSA-vf7q-g2pv-jxvx

Affected products (as reported)

Vendor	Product	Versions
pimcore	pimcore	< 10.5.19

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

References

https://github.com/pimcore/pimcore/security/advisories/GHSA-vf7q-g2pv-jxvx x_refsource_CONFIRM
https://github.com/pimcore/pimcore/pull/14526 x_refsource_MISC
https://github.com/pimcore/pimcore/commit/d1abadb181c88ebaa4bce1916f9077469d4ea2bc.patch x_refsource_MISC