CVE-2023-28108: Pimcore has improper quoting of columns when calling methods "getByUuid" & "exists" on UUID Model
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model. There is the theoretical possibility to inject custom SQL if the developer is using this methods with input data and not doing proper input validation in advance and so relies on the auto-quoting being done by the DAO class. Users should update to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-28108?
CVE-2023-28108 is a vulnerability in Pimcore, an open source data and experience management platform, that allows for custom SQL injection due to improper quoting in the UUID DAO model.
What is the severity of CVE-2023-28108?
The severity of CVE-2023-28108 is high with a CVSS score of 7.8.
How does CVE-2023-28108 affect Pimcore?
CVE-2023-28108 affects Pimcore versions up to and excluding 10.5.19.
How can CVE-2023-28108 be fixed?
To fix CVE-2023-28108, it is recommended to update to Pimcore version 10.5.19 or later.
What are the CWEs associated with CVE-2023-28108?
The CWEs associated with CVE-2023-28108 are 20 (Improper Input Validation) and 89 (SQL Injection).