CVE-2025-24980: User Enumeration Vulnerability in Pimcore Admin Classic Bundle
Summary
CVE-2025-24980: Pimcore Admin Classic Bundle allows user enumeration. Affects pimcore/admin-ui-classic-bundle versions < 1.7.4. Fixed in 1.7.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pimcore Admin Classic Bundle is a component of the Pimcore platform, which is designed for managing digital assets and content. This bundle provides an administrative interface for users to manage their accounts and perform various tasks related to the Pimcore ecosystem. The bundle's functionality includes user authentication, password recovery, and account management. However, it has been identified that the 'Forgot password' feature is susceptible to user enumeration attacks, where an attacker can determine valid account emails based on the responses received from the system.
Vulnerability Detail
The vulnerability arises from the implementation of the 'Forgot password' functionality, which provides different messages for valid and invalid email addresses. When a valid email is submitted, the system responds with a confirmation message indicating that a login link has been sent. Conversely, if an invalid email is submitted, the system returns a generic error message. This discrepancy allows attackers to enumerate valid accounts by testing various email addresses, potentially leading to further attacks such as credential stuffing or account takeover.
How To Fix
Minimum fixed version
1.7.4
This is the first release that contains the fix.
composer require pimcore/admin-ui-classic-bundle:1.7.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a synchronized error message for both valid and invalid email submissions. Instead of providing specific feedback about the validity of the email, you can use a generic message such as: 'If the given email address is linked to an account, then a login link would be sent to that email.' This will help prevent attackers from determining valid accounts.
Conclusion
The user enumeration vulnerability in the Pimcore Admin Classic Bundle poses a significant risk to account security. By updating to the patched version and implementing a synchronized error message, organizations can mitigate this risk and protect their user accounts from potential attacks.
See every vulnerability recorded for pimcore/admin-ui-classic-bundle →
FAQ
User enumeration is a security vulnerability that allows an attacker to determine valid usernames or email addresses in a system by analyzing the responses from the application.
An attacker can exploit this vulnerability by systematically testing various email addresses in the 'Forgot password' feature and observing the responses to identify valid accounts.
The consequences include unauthorized access to user accounts through credential stuffing attacks, which can lead to data breaches and loss of sensitive information.
Yes, a patch is available in version 1.7.4 of the Pimcore Admin Classic Bundle. It is recommended to update to this version or later.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By uploading your composer.lock file, Vulert can alert you in real-time about any vulnerabilities, including this one.
References
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/admin-ui-classic-bundle.
