CVE-2019-10867: High severity pimcore e-commerce framework vulnerability
An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.
Other sources
An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10867?
CVE-2019-10867 has a high severity level, as it allows remote code execution through an unserialize vulnerability.
How do I fix CVE-2019-10867?
To fix CVE-2019-10867, upgrade Pimcore to version 5.7.1 or later.
What software is affected by CVE-2019-10867?
CVE-2019-10867 affects Pimcore versions before 5.7.1.
How can an attacker exploit CVE-2019-10867?
An attacker can exploit CVE-2019-10867 by sending a specially crafted POST request to /admin/class/bulk-commit.
What type of vulnerability is CVE-2019-10867?
CVE-2019-10867 is an unserialize vulnerability that can lead to remote code execution.