CVE-2019-10867

An issue was discovered in Pimcore before 5.7.1

published April 4, 2019

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.3th percentile for exploit probability.

CVSS

—

EPSS

69%

Percentile

99.3

In the wild

Unconfirmed

What it is

An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.68874 · 99.3th percentile
Published: 2019-04-04T17:51Z

EPSS history

Timeline

04 APR 17:51Z
An issue was discovered in Pimcore before 5.7.1
cvelistv5