CVE-2023-32075: Pimcore vulnerable to Business Logic Errors in Customer automation rules
The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management. In pimcore/customer-management-framework-bundle prior to version 3.3.9, business logic errors are possible in the Conditions tab since the counter can be a negative number. This vulnerability is capable of the unlogic in the counter value in the Conditions tab. Users should update to version 3.3.9 to receive a patch or, as a workaround, or apply the patch manually.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-32075?
CVE-2023-32075 is a vulnerability in the Customer Management Framework (CMF) for Pimcore that allows for business logic errors in the Conditions tab.
What is the severity of CVE-2023-32075?
CVE-2023-32075 has a severity of 4.3, which is considered medium.
How does CVE-2023-32075 affect Pimcore?
CVE-2023-32075 affects the 'pimcore/customer-management-framework-bundle' prior to version 3.3.9, causing possible business logic errors in the Conditions tab.
How can CVE-2023-32075 be fixed?
To fix CVE-2023-32075, update 'pimcore/customer-management-framework-bundle' to version 3.3.9 or later.
Is there a patch available for CVE-2023-32075?
Yes, a patch for CVE-2023-32075 is available at the following link: [Patch Link](https://github.com/pimcore/customer-data-framework/commit/e3f333391582d9309115e6b94e875367d0ea7163.patch).