CVE-2023-28438CWE-89

Pimcore vulnerable to improper quoting of filters in Custom Reports

Medium · published March 22, 2023

CVSS v3.1
6.2
EPSS
1%
Percentile
58.0
In the wild
Unconfirmed
What it is

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00856 · 58.0th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2023-03-22T20:46Z
EPSS history
Timeline
  • 22 MAR 20:46Z
    Pimcore vulnerable to improper quoting of filters in Custom Reports
    cvelistv5