GHSA-g8jx-66p8-vcm2

ghsaUSosv

SQL injection in pimcore/pimcore

view advisory published 2021-07-13Licence: CC-BY-4.0

This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-23405US	high8.8	1.71% (77th)	—	2021-07-09
This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGe…

references

External citations — patches, advisories, analysis.

https://github.com/pimcore/pimcore/pull/9572WEB
https://nvd.nist.gov/vuln/detail/CVE-2021-23405ADVISORY
https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-1316297WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan