What is GHSA-25fx-3c2q-cq46?

GHSA-25fx-3c2q-cq46 is a security advisory published by GitHub Security Advisories with High severity. pimcore/customer-management-framework-bundle has SQL Injection vulnerability in Segment Assignment query

Which CVE IDs does GHSA-25fx-3c2q-cq46 cover?

GHSA-25fx-3c2q-cq46 covers the following CVE IDs: CVE-2023-2756. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-25fx-3c2q-cq46?

GHSA-25fx-3c2q-cq46 has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

Which products are affected by GHSA-25fx-3c2q-cq46?

GHSA-25fx-3c2q-cq46 affects 1 product, including: composer/pimcore/customer-management-framework-bundle:\u003c 3.3.10.

GHSA-25fx-3c2q-cq46HighCVSS 7.2

pimcore/customer-management-framework-bundle has SQL Injection vulnerability in Segment Assignment query

Vendor

GitHub Security Advisories

Published

May 17, 2023

Last Modified

November 7, 2023

🔗 CVE IDs covered (1)

CVE-2023-2756 →

📋 Description

Impact

An administrator user can use the inheritable segments feature to execute his own blind SQL queries.

A user with administrator privileges can run any SQL query on database. This can be used to retrieve sensitive data, change database information or any other malicious activity against the database.

Patches

Update to version 3.3.10 or apply this patch manually https://github.com/pimcore/customer-data-framework/commit/76df151737b7964ce5169fdf9e27a0ad801757fe.patch

Workarounds

Apply https://github.com/pimcore/customer-data-framework/commit/76df151737b7964ce5169fdf9e27a0ad801757fe.patch manually.

References

https://huntr.dev/bounties/cf398528-819f-456e-88e7-c06d268d3f44/

🎯 Affected products1

composer/pimcore/customer-management-framework-bundle:< 3.3.10