CVE-2023-5844: Unverified Password Change in pimcore/admin-ui-classic-bundle
Impact As old password can be set as new password , it is considered as password policy violation.
Pimcore is not enforcing strict password policy which allow attacker to set old password as new password
Proof of Concept 1. Go to Admin link 2. login and click on -> "User | My Profile". 3. Go to change password now put old password as new password and click save.
Patches https://github.com/pimcore/admin-ui-classic-bundle/commit/498ac77e54541177be27b0c710e387c47b3836ea.patch
Workarounds Update to version 1.2.0 or apply this patches manually https://github.com/pimcore/admin-ui-classic-bundle/commit/498ac77e54541177be27b0c710e387c47b3836ea.patch
References https://huntr.com/bounties/b031199d-192a-46e5-8c02-f7284ad74021/
Other sources
Unverified Password Change in GitHub repository pimcore/admin-ui-classic-bundle prior to 1.2.0.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-5844?
The severity of CVE-2023-5844 is medium with a CVSS score of 4.3.
What is the impact of CVE-2023-5844?
CVE-2023-5844 allows an attacker to set an old password as the new password in Pimcore, violating password policy.
How can an attacker exploit CVE-2023-5844?
To exploit CVE-2023-5844, an attacker can go to the Admin link, log in, and click on "User | My Profile" to set an old password as the new password.
What is the affected software of CVE-2023-5844?
The affected software of CVE-2023-5844 is pimcore/admin-ui-classic-bundle version up to exclusive 1.2.0.
Is there a fix for CVE-2023-5844?
Yes, the fixed version for CVE-2023-5844 is pimcore/admin-ui-classic-bundle version 1.2.0 or later.