CVE-2023-49075CWE-308

Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls

High · published November 28, 2023

CVSS v3.1
8.5
EPSS
1%
Percentile
72.9
In the wild
Unconfirmed
What it is

The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without having to provide the two factor credentials. This issue has been patched in version 1.2.2.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01437 · 72.9th percentile
Weakness
CWE-308 · Use of Single-factor Authentication
Published
2023-11-28T04:33Z
EPSS history
Timeline
  • 28 NOV 04:33Z
    Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
    cvelistv5