CVE-2024-21665CWE-284

Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list

Medium · published January 11, 2024

CVSS v3.1
4.3
EPSS
0%
Percentile
41.3
In the wild
Unconfirmed
What it is

ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Access control and permissions are not being enforced. This vulnerability has been patched in version 1.0.10.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00490 · 41.3th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-01-11T00:39Z
EPSS history
Timeline
  • 11 JAN 00:39Z
    Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list
    cvelistv5