CVE-2023-3574: Improper Authorization in pimcore/customer-data-framework
Impact The product performs authorization checks incorrectly when an unauthorized actor tries to access a resource or perform an actions.
The attacker can view and freely perform actions to add, modify, or delete rules.
Patches Update to version 3.4.1 or apply this patch manually https://github.com/pimcore/customer-data-framework/commit/f15668c86db254e86ba7ac895bc3cdd1a2a3cc45.patch
Workarounds Apply https://github.com/pimcore/customer-data-framework/commit/f15668c86db254e86ba7ac895bc3cdd1a2a3cc45.patch manually.
References https://huntr.dev/bounties/1dcb4f01-e668-4aa3-a6a3-838532e500c6/
Other sources
Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/pimcore/customer-management-framework-bundleto a version that resolves this vulnerability.Fixed in 3.4.1 - Upgrade
Upgrade
pimcore/customer-data-frameworkto a version that resolves this vulnerability.Fixed in 3.4.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch f15668c86db254e86ba7ac895bc3cdd1a2a3cc45
Event History
Frequently Asked Questions
What is the impact of CVE-2023-3574?
The product performs authorization checks incorrectly when an unauthorized actor tries to access a resource or perform an actions, allowing the attacker to view and freely perform actions to add, modify, or delete rules.
How can I patch CVE-2023-3574?
You can update to version 3.4.1 or manually apply the patch provided at the given URL: [Patch URL](https://github.com/pimcore/customer-data-framework/commit/f15668c86db254e86ba7ac895bc3cdd1a2a3cc45).
What is the severity of CVE-2023-3574?
The severity of CVE-2023-3574 is medium with a CVSS score of 6.5.
What is the CWE category of CVE-2023-3574?
CVE-2023-3574 falls under CWE categories 285 and 863.