Back to CVE Browser

CVE-2019-10867

HIGH

8.8

CVSS Severity Score

EPSS Score0.1950%

EPSS Percentile20.66th

PublishedApr 4, 2019

Last ModifiedNov 21, 2024

Vulnerability Description

An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.

Affected Platforms (CPE)

📦

Pimcore

Pimcore

< 5.7.1

References & Advisories

🔗 http://packetstormsecurity.com/files/152667/Pimcore-Unserialize-Remote-Code-Execution.html

🔗 http://www.rapid7.com/db/modules/exploit/multi/http/pimcore_unserialize_rce

🔗 https://blog.certimetergroup.com/it/articolo/security/polyglot_phar_deserialization_to_rce

🔗 https://github.com/pimcore/pimcore/commit/38a29e2f4f5f060a73974626952501cee05fda73

🔗 https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-173998

🔗 https://www.exploit-db.com/exploits/46783/

🔗 http://packetstormsecurity.com/files/152667/Pimcore-Unserialize-Remote-Code-Execution.html

🔗 http://www.rapid7.com/db/modules/exploit/multi/http/pimcore_unserialize_rce

Related Vulnerabilities

CVE-2019-189859.8

Pimcore before 6.2.2 lacks brute force protection for the 2FA token.

CVE-2019-189819.8

Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.

CVE-2021-41399.0

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-163178.8

In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename...