CVE-2023-3820: SQL Injection in pimcore/pimcore
First published: Fri Jul 21 2023(Updated: )
SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4.
Credit: security@huntr.dev security@huntr.dev security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pimcore Pimcore | <10.6.4 | |
| composer/pimcore/pimcore | <10.6.4 | 10.6.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97
- https://huntr.dev/bounties/b00a38b6-d040-494d-bf46-38f46ac1a1db
- https://github.com/pimcore/pimcore/security/advisories/GHSA-c9hw-557q-f8hq
- https://nvd.nist.gov/vuln/detail/CVE-2023-3820
- https://github.com/advisories/GHSA-c9hw-557q-f8hq (Advisory)
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2023-3820.
What is the severity of CVE-2023-3820?
The severity of CVE-2023-3820 is high with a severity value of 7.
How does the SQL Injection vulnerability in GitHub repository pimcore/pimcore prior to 10.6.4 impact the system?
The vulnerability allows an attacker to use SQL exploitation tools to enumerate all information in the database, alter data, or perform DoS attacks on the backend database.
How can I fix CVE-2023-3820?
You can fix CVE-2023-3820 by updating to version 10.6.5 of pimcore/pimcore or manually applying the patch provided by the GitHub commit: https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97.
Are there any references for CVE-2023-3820?
Yes, you can find more information about CVE-2023-3820 in the following references: [Reference 1](https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97), [Reference 2](https://huntr.dev/bounties/b00a38b6-d040-494d-bf46-38f46ac1a1db), [Reference 3](https://github.com/pimcore/pimcore/security/advisories/GHSA-c9hw-557q-f8hq).
- collector/github-advisory-latest
- alias/GHSA-c9hw-557q-f8hq
- alias/CVE-2023-3820
- collector/github-advisory
- collector/nvd-latest
- collector/nvd-index
- collector/nvd-cve
- agent/type
- agent/remedy
- agent/softwarecombine
- collector/epss-latest
- source/FIRST
- agent/author
- agent/severity
- agent/weakness
- agent/references
- agent/description
- agent/epss
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/tags
- agent/event
- agent/first-publish-date
- package-manager/composer
- vendor/pimcore
- canonical/pimcore pimcore