CVE-2014-2922: Input Validation
The getObjectByToken function in Newsletter.php in the PimcoreToolNewsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtained by unserializing a pathname, which allows remote attackers to conduct PHP object injection attacks and delete arbitrary files via vectors involving a ZendHttpResponseStream object.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2922?
CVE-2014-2922 is considered a high-severity vulnerability due to its potential for PHP object injection attacks.
How do I fix CVE-2014-2922?
To fix CVE-2014-2922, it is recommended to upgrade Pimcore to version 2.2.0 or higher.
What versions of Pimcore are affected by CVE-2014-2922?
CVE-2014-2922 affects Pimcore versions 1.4.9, 1.5.0, and 2.1.0.
Can CVE-2014-2922 lead to remote code execution?
Yes, CVE-2014-2922 can potentially allow remote attackers to execute arbitrary code through object injection.
Is CVE-2014-2922 related to file deletion vulnerabilities?
Yes, CVE-2014-2922 can be exploited to delete arbitrary files on the server due to improper handling of unserialized objects.