CVE-2024-41109 MEDIUM

CVE-2024-41109: Pimcore vulnerable to disclosure of system and database information behind /admin firewall

Vendor Pimcore
Product admin-ui-classic-bundle
Weakness CWE-200 · Info exposure
Published July 30, 2024
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.

Key dates

02Disclosure timeline

July 30, 2024 CVE published
August 2, 2024 Record updated