CVE-2018-14057: CSRF
Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-csrf-token anti-CSRF token only in the "Settings > Users / Roles" function.
Other sources
Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-csrf-token anti-CSRF token only in the "Settings > Users / Roles" function.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-14057?
CVE-2018-14057 is categorized as a medium severity vulnerability due to its potential impact on application security.
How do I fix CVE-2018-14057?
To resolve CVE-2018-14057, upgrade to Pimcore version 5.3.0 or later.
What kind of attacks does CVE-2018-14057 allow?
CVE-2018-14057 allows remote attackers to conduct cross-site request forgery (CSRF) attacks.
Which versions of Pimcore are affected by CVE-2018-14057?
Pimcore versions prior to 5.3.0 are affected by CVE-2018-14057.
What functionality is specifically vulnerable in CVE-2018-14057?
CVE-2018-14057 specifically affects the "Settings > Users / Roles" functionality by improperly validating the CSRF token.