What is GHSA-r87r-982q-2c3q?

GHSA-r87r-982q-2c3q is a security advisory published by GitHub Security Advisories with High severity. Pimcore vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Which CVE IDs does GHSA-r87r-982q-2c3q cover?

GHSA-r87r-982q-2c3q covers the following CVE IDs: CVE-2023-3819. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-r87r-982q-2c3q?

GHSA-r87r-982q-2c3q has a CVSS v3 base score of 7.6, published by GitHub Security Advisories.

Which products are affected by GHSA-r87r-982q-2c3q?

GHSA-r87r-982q-2c3q affects 1 product, including: composer/pimcore/pimcore:\u003c 10.6.4.

GHSA-r87r-982q-2c3qHighCVSS 7.6

Pimcore vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Vendor

GitHub Security Advisories

Published

July 21, 2023

Last Modified

November 5, 2023

🔗 CVE IDs covered (1)

CVE-2023-3819 →

📋 Description

Impact

Unauthorized users are able to obtain sensitive information about the system's runtime environment, features they have no permissions to access, etc.

Patches

Update to version 10.6.4 or apply this patch manually https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54.patch

Workarounds

Apply patch https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54.patch manually.

References

https://huntr.dev/bounties/be5e4d4c-1b0b-4c01-a1fc-00533135817c/

🎯 Affected products1

composer/pimcore/pimcore:< 10.6.4

🔗 References (5)

https://github.com/pimcore/pimcore/security/advisories/GHSA-r87r-982q-2c3q
https://nvd.nist.gov/vuln/detail/CVE-2023-3819
https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54
https://huntr.dev/bounties/be5e4d4c-1b0b-4c01-a1fc-00533135817c
https://github.com/advisories/GHSA-r87r-982q-2c3q