CVE-2023-3819: Exposure of Sensitive Information to an Unauthorized Actor in pimcore/pimcore
Impact Unauthorized users are able to obtain sensitive information about the system's runtime environment, features they have no permissions to access, etc.
Patches Update to version 10.6.4 or apply this patch manually https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54.patch
Workarounds Apply patch https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54.patch manually.
References https://huntr.dev/bounties/be5e4d4c-1b0b-4c01-a1fc-00533135817c/
Other sources
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pimcore/pimcore prior to 10.6.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/pimcore/pimcoreto a version that resolves this vulnerability.Fixed in 10.6.4 - Upgrade
Upgrade
pimcore/pimcoreto a version that resolves this vulnerability.Fixed in 10.6.4 - Upgrade
Upgrade
pimcore/pimcoreto a version that resolves this vulnerability.Patch 0237527b3244d251fa5ecd4912dfe4f8b2125c54
Event History
Frequently Asked Questions
What is the impact of CVE-2023-3819?
Unauthorized users can obtain sensitive information about the system's runtime environment and features they have no permissions to access.
How can I patch CVE-2023-3819?
Update to version 10.6.4 or apply the patch manually from the GitHub commit: https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54
What is the severity of CVE-2023-3819?
The severity of CVE-2023-3819 is high, with a severity value of 7.
Which software versions are affected by CVE-2023-3819?
Software versions up to but exclusive of 10.6.4 are affected by CVE-2023-3819.
Is there any additional information available about CVE-2023-3819?
For more information, you can refer to the following resources: [GitHub Commit](https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54), [Huntr Bounty](https://huntr.dev/bounties/be5e4d4c-1b0b-4c01-a1fc-00533135817c), [GitHub Security Advisory](https://github.com/pimcore/pimcore/security/advisories/GHSA-r87r-982q-2c3q).