Vulnerability · Published Mar 16, 2023 · Assigned by GitHub_M

CVE-2023-28108Pimcore has improper quoting of columns when calling methods "getByUuid" & "exists" on UUID Model

High 7.9

In plain English

A high-severity SQL injection in pimcore from pimcore. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.9High

Exploit odds (30 days)0.9%top 41.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model. There is the theoretical possibility to inject custom SQL if the developer is using this methods with input data and not doing proper input validation in advance and so relies on the auto-quoting being done by the DAO class. Users should update to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	pimcore/pimcore	10.5.19	GHSA-xc9p-r5qj-8xm9

Affected products (as reported)

Vendor	Product	Versions
pimcore	pimcore	< 10.5.19

Weakness: CWE-89 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

References

https://github.com/pimcore/pimcore/security/advisories/GHSA-xc9p-r5qj-8xm9 x_refsource_CONFIRM
https://github.com/pimcore/pimcore/pull/14633 x_refsource_MISC
https://github.com/pimcore/pimcore/commit/08e7ba56ae983c3c67ec563b6989b16ef8f35275.patch x_refsource_MISC