Vulnerability · Published May 11, 2023 · Assigned by GitHub_M

CVE-2023-32075Pimcore vulnerable to Business Logic Errors in Customer automation rules

Medium 4.3

In plain English

A medium-severity improper input validation in customer-data-framework from pimcore. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.8%top 44.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management. In `pimcore/customer-management-framework-bundle` prior to version 3.3.9, business logic errors are possible in the `Conditions` tab since the counter can be a negative number. This vulnerability is capable of the unlogic in the counter value in the Conditions tab. Users should update to version 3.3.9 to receive a patch or, as a workaround, or apply the patch manually.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	pimcore/customer-management-framework-bundle	3.3.9	GHSA-x99j-r8vv-gwwj

Affected products (as reported)

Vendor	Product	Versions
pimcore	customer-data-framework	< 3.3.9

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/pimcore/customer-data-framework/security/advisories/GHSA-x99j-r8vv-gwwj x_refsource_CONFIRM
https://github.com/pimcore/customer-data-framework/commit/e3f333391582d9309115e6b94e875367d0ea7163.patch x_refsource_MISC
https://github.com/pimcore/customer-data-framework/releases/tag/v3.3.9 x_refsource_MISC
https://huntr.dev/bounties/cecd7800-a996-4f3a-8689-e1c2a1e0248a/ x_refsource_MISC