CVE-2019-18981: Critical severity pimcore e-commerce framework vulnerability
Published Nov 15, 2019
·Updated
Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.
Affected Software
2 affected componentsFixes available
composer/pimcore/pimcore<6.2.2
6.2.2
Pimcore pimcore<6.2.2
Remediation
Patch Available
Event History
Nov 15, 2019
CVE Published
via MITRE·04:22 AM
Data Sourced
via MITRE·04:22 AM
Description
May 24, 2022
Advisory Published
05:01 PM
Frequently Asked Questions
1
What is the severity of CVE-2019-18981?
CVE-2019-18981 has a severity rating that poses a risk to access control in affected versions of Pimcore.
2
How do I fix CVE-2019-18981?
To fix CVE-2019-18981, upgrade your Pimcore installation to version 6.2.2 or later.
3
What versions of Pimcore are affected by CVE-2019-18981?
All versions of Pimcore prior to 6.2.2 are affected by CVE-2019-18981.
4
What type of issue is CVE-2019-18981?
CVE-2019-18981 is an access control vulnerability that can lead to unauthorized notification delivery.
5
Is there a workaround for CVE-2019-18981?
There is no documented workaround for CVE-2019-18981; the best action is to update to a patched version.