CVE-2023-3820: SQL Injection in pimcore/pimcore
Impact Using some SQL exploitation tools such as sqlmap, an attacker can enumerate all information in the database, alter data or perform dos on the backend database.
Patches Update to version 10.6.5 or apply this patch manually https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97.patch
Workarounds Apply patch https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97.patch manually.
References https://huntr.dev/bounties/b00a38b6-d040-494d-bf46-38f46ac1a1db/
Other sources
SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/pimcore/pimcoreto a version that resolves this vulnerability.Fixed in 10.6.4 - Upgrade
Upgrade
pimcore/pimcoreto a version that resolves this vulnerability.Fixed in 10.6.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch e641968979d4a2377bbea5e2a76bdede040d0b97
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2023-3820.
What is the severity of CVE-2023-3820?
The severity of CVE-2023-3820 is high with a severity value of 7.
How does the SQL Injection vulnerability in GitHub repository pimcore/pimcore prior to 10.6.4 impact the system?
The vulnerability allows an attacker to use SQL exploitation tools to enumerate all information in the database, alter data, or perform DoS attacks on the backend database.
How can I fix CVE-2023-3820?
You can fix CVE-2023-3820 by updating to version 10.6.5 of pimcore/pimcore or manually applying the patch provided by the GitHub commit: https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97.
Are there any references for CVE-2023-3820?
Yes, you can find more information about CVE-2023-3820 in the following references: [Reference 1](https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97), [Reference 2](https://huntr.dev/bounties/b00a38b6-d040-494d-bf46-38f46ac1a1db), [Reference 3](https://github.com/pimcore/pimcore/security/advisories/GHSA-c9hw-557q-f8hq).