CVE-2023-49076CWE-352

Pimcore missing token/header to prevent CSRF

Medium · published November 30, 2023

CVSS v3.1
4.3
EPSS
0%
Percentile
16.5
In the wild
Unconfirmed
What it is

Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an attacker could abuse this vulnerability to create new customers. This issue has been patched in version 4.0.5.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00258 · 16.5th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2023-11-30T05:42Z
EPSS history
Timeline
  • 30 NOV 05:42Z
    Pimcore missing token/header to prevent CSRF
    cvelistv5