CVE-2014-2921: Code Injection
The getObjectByToken function in Newsletter.php in the PimcoreToolNewsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a ZendPdfElementFactoryProxy object and a pathname with a trailing \0 character.
Other sources
The getObjectByToken function in Newsletter.php in the PimcoreToolNewsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a ZendPdfElementFactoryProxy object and a pathname with a trailing \0 character.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/pimcore/pimcoreto a version that resolves this vulnerability.Fixed in 2.2.0
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2921?
CVE-2014-2921 has a high severity rating due to its potential for PHP object injection and remote code execution.
How do I fix CVE-2014-2921?
To mitigate CVE-2014-2921, upgrade your Pimcore installation to version 2.2.0 or later.
Which versions are affected by CVE-2014-2921?
CVE-2014-2921 affects Pimcore versions 1.4.9 through 2.0.0.
What types of attacks can CVE-2014-2921 facilitate?
CVE-2014-2921 can facilitate PHP object injection attacks that could lead to arbitrary code execution.
Is it safe to use Pimcore versions prior to 2.2.0 after CVE-2014-2921?
Using Pimcore versions prior to 2.2.0 poses a security risk due to the vulnerability identified in CVE-2014-2921.