CVE-2023-25240: High severity pimcore e-commerce framework vulnerability
Published Feb 13, 2023
·Updated
An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code.
Affected Software
2 affected componentsFixes available
Pimcore pimcore=10.5.15
composer/pimcore/pimcore<10.5.16
10.5.16
Event History
Feb 13, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Advisory Published
via GitHub·09:31 PM
Frequently Asked Questions
1
What is the severity of CVE-2023-25240?
CVE-2023-25240 is a critical vulnerability allowing arbitrary code execution due to improper SameSite Attribute implementation.
2
How do I fix CVE-2023-25240?
To fix CVE-2023-25240, update Pimcore to version 10.5.16 or later where the vulnerability is patched.
3
What versions of Pimcore are affected by CVE-2023-25240?
Pimcore version 10.5.15 is affected by CVE-2023-25240.
4
Can CVE-2023-25240 lead to data compromise?
Yes, CVE-2023-25240 can potentially lead to data compromise by allowing attackers to execute arbitrary code.
5
Is authentication required to exploit CVE-2023-25240?
No, CVE-2023-25240 can be exploited without authentication.