Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveGitHub_MCVE-2023-49075
HistoryNov 28, 2023 - 5:15 a.m.

CVE-2023-49075

2023-11-2805:15:08
CWE-308
GitHub_M
web.nvd.nist.gov
27
admin classic bundle
pimcore
backend ui
security
vulnerability
authentication
patch

CVSS3

8.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

28.5%

JSON

The Admin Classic Bundle provides a Backend UI for Pimcore. AdminBundle\Security\PimcoreUserTwoFactorCondition introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without having to provide the two factor credentials. This issue has been patched in version 1.2.2.

Affected configurations

Nvd
Vulners
Node
pimcoreadmin_classic_bundleRange<1.2.2pimcore
VendorProductVersionCPE
pimcoreadmin_classic_bundle*cpe:2.3:a:pimcore:admin_classic_bundle:*:*:*:*:*:pimcore:*:*

CNA Affected

[
  {
    "vendor": "pimcore",
    "product": "admin-ui-classic-bundle",
    "versions": [
      {
        "version": "< 1.2.2",
        "status": "affected"
      }
    ]
  }
]

Related

prion 1
cvelist 1
veracode 1
github 1
osv 2
nvd 1
prion
prion
Design/Logic Flaw
2023-11-28 05:15:00
cvelist
cvelist
CVE-2023-49075 Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
2023-11-28 04:33:23
veracode
veracode
Authentication Bypass
2023-11-29 09:13:13
github
github
Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
2023-11-27 23:23:02
osv
osv
Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
2023-11-27 23:23:02
CVE-2023-49075
2023-11-28 05:15:08
nvd
nvd
CVE-2023-49075
2023-11-28 05:15:08

CVSS3

8.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

28.5%

JSON
Related for CVE-2023-49075
prion1cvelist1veracode1github1osv2nvd1