CVE-2024-24822: Pimcore Admin Classic Bundle permissions bypass vulnerability
Summary
CVE-2024-24822: Pimcore Admin Classic Bundle permissions are not getting checked when working with tags. Affects pimcore/admin-ui-classic-bundle versions < 1.3.3. Fixed in 1.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pimcore Admin Classic Bundle is a package available on Packagist that provides a classic user interface for managing administrative tasks in the Pimcore content management system. It offers various features and functionalities to facilitate the management of tags within the admin panel.
Vulnerability Detail
The Pimcore Admin Classic Bundle is affected by a permissions bypass vulnerability. This vulnerability allows an attacker to perform actions related to tags without having the necessary permissions. Consequently, an unauthorized user can create, delete, or modify tags within the admin panel, potentially compromising the integrity and availability of the system. This vulnerability can be exploited by an intruder who adds text parameters with random numbers, leading to a broken access control scenario.
How To Fix
Minimum fixed version
1.3.3
This is the first release that contains the fix.
composer require pimcore/admin-ui-classic-bundle:1.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, you can apply the fix manually by following the instructions provided in the pull request: [link to pull request]. This workaround should be considered temporary, and it is strongly advised to update to the latest version of the package as soon as possible.
Conclusion
The Pimcore Admin Classic Bundle is affected by a permissions bypass vulnerability that allows unauthorized users to manipulate tags within the admin panel. To mitigate this risk, it is recommended to update the package to version 1.3.3 or later. If immediate updating is not possible, a temporary workaround can be applied by following the provided instructions. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pimcore/admin-ui-classic-bundle →
FAQ
The vulnerability allows unauthorized users to manipulate tags within the admin panel, compromising the integrity and availability of the system.
To mitigate the risk, it is recommended to update the Pimcore Admin Classic Bundle to version 1.3.3 or later.
There are no known instances of this vulnerability being exploited in the wild at this time.
Yes, you can manually apply the provided fix by following the instructions in the pull request. However, it is crucial to update to the latest version as soon as possible.
You can find more information about this vulnerability in the official GitHub advisory: [link to advisory].
References
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/admin-ui-classic-bundle.
