Back to CVE Browser

CVE-2020-26246

HIGH

7.7

CVSS Severity Score

EPSS Score0.0670%

EPSS Percentile9.53th

PublishedDec 3, 2020

Last ModifiedNov 21, 2024

Vulnerability Description

Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the appropriate permissions.

Affected Platforms (CPE)

📦

Pimcore

Pimcore

< 6.8.5

References & Advisories

🔗 https://github.com/pimcore/pimcore/pull/7618

🔗 https://github.com/pimcore/pimcore/security/advisories/GHSA-7p8p-4253-3mg6

🔗 https://github.com/pimcore/pimcore/pull/7618

🔗 https://github.com/pimcore/pimcore/security/advisories/GHSA-7p8p-4253-3mg6

Related Vulnerabilities

CVE-2019-189859.8

Pimcore before 6.2.2 lacks brute force protection for the 2FA token.

CVE-2019-189819.8

Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.

CVE-2021-41399.0

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-163188.8

In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, ...