Vulnerability · Published Oct 23, 2024 · Assigned by GitHub_M

CVE-2024-49370Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing

High 8.7

In plain English

A high-severity security flaw in pimcore from pimcore. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.5%top 55.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Pimcore is an open source data and experience management platform. When a PortalUserObject is connected to a PimcoreUser and "Use Pimcore Backend Password" is set to true, the change password function in Portal Profile sets the new password. Prior to Pimcore portal engine versions 4.1.7 and 3.1.16, the password is then set without hashing so it can be read by everyone. Everyone who combines PortalUser to PimcoreUsers and change passwords via profile settings could be affected. Versions 4.1.7 and 3.1.16 of the Pimcore portal engine fix the issue.

Affected products (as reported)

Vendor	Product	Versions
pimcore	pimcore	< 3.1.16>= 4.0.0, < 4.1.7

Weakness: CWE-256 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/pimcore/pimcore/security/advisories/GHSA-74p5-77rq-gfqc x_refsource_CONFIRM