CVE-2021-23405: SQL Injection
Published Jul 9, 2021
·Updated
This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class.
Affected Software
1 affected component
Pimcore pimcore<10.0.7
Remediation
Patch Available
Event History
Jul 9, 2021
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-23405?
The severity of CVE-2021-23405 is classified as medium due to potential unauthorized access risks.
2
How do I fix CVE-2021-23405?
To fix CVE-2021-23405, you should upgrade to pimcore/pimcore version 10.0.7 or later.
3
What software is affected by CVE-2021-23405?
CVE-2021-23405 affects Pimcore versions prior to 10.0.7.
4
What is the root cause of CVE-2021-23405?
The root cause of CVE-2021-23405 is the lack of validation on the storeId parameter in specific methods of the ClassificationstoreController.
5
Are there any known exploits for CVE-2021-23405?
As of now, there are no publicly disclosed exploits for CVE-2021-23405, but it poses a risk if not mitigated.