CVE-2021-23405

SQL Injection

High · published July 9, 2021

CVSS v3.1
8.3
EPSS
2%
Percentile
77.2
In the wild
Unconfirmed
What it is

This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L/E:F/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.01715 · 77.2th percentile
Published
2021-07-09T12:40Z
EPSS history
Timeline
  • 09 JUL 12:40Z
    SQL Injection
    cvelistv5