CVE-2023-49076

2023-11-3006:15:46

Google

osv.dev

customer data

pimcore

csrf attacks

vulnerability

software update

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

20.1%

JSON

Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an attacker could abuse this vulnerability to create new customers. This issue has been patched in version 4.0.5.