CVE-2024-21666: Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list
Summary An authenticated and unauthorized user can access the list of potential duplicate users and see their data.
Details Permissions do not seem to be enforced when reaching the /admin/customermanagementframework/duplicates/list endpoint allowing an authenticated user without the permissions to access the endpoint and query the data available there. It seems that the access control is not enforced in this place : <https://github.com/pimcore/customer-data-framework/blob/b4af625ef327c58d05ef7cdf145fa749d2d4195e/src/Controller/Admin/DuplicatesController.php#L43>
PoC In order to reproduce the issue, the following steps can be followed :
1. As an administrator : a. Create a role without any permission through Settings → User & Roles → Roles in the administration panel b. Create an user through Settings → User & Roles → Users and assign it the unprivileged role previously created 2. Log out the current administrator and log in with this new user 3. Access to the following endpoint https://pimcoreinstance/admin/customermanagementframework/duplicates/list and the results will be returned to this unauthorized user
Impact An unauthorized user can access PII data from customers without being authorized to.
Other sources
The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management, segmentation, personalization and marketing automation. An authenticated and unauthorized user can access the list of potential duplicate users and see their data. Permissions are enforced when reaching the /admin/customermanagementframework/duplicates/list endpoint allowing an authenticated user without the permissions to access the endpoint and query the data available there. Unauthorized user(s) can access PII data from customers. This vulnerability has been patched in version 4.0.6.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/pimcore/customer-management-framework-bundleto a version that resolves this vulnerability.Fixed in 4.0.6 - Upgrade
Upgrade
pimcore/customer-data-frameworkto a version that resolves this vulnerability.Fixed in 4.0.6
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21666?
CVE-2024-21666 is classified as a medium severity vulnerability due to the potential for unauthorized data exposure.
What does CVE-2024-21666 allow an attacker to do?
CVE-2024-21666 allows an authenticated user to access and view the list of potential duplicate users and their associated data without the necessary permissions.
How do I fix CVE-2024-21666?
To fix CVE-2024-21666, ensure that proper permission checks are implemented at the '/admin/customermanagementframework/duplicates/list' endpoint.
Which software versions are affected by CVE-2024-21666?
CVE-2024-21666 affects versions of the Pimcore Customer Management Framework up to and including 4.0.6.
Who is at risk from CVE-2024-21666?
Organizations using the affected versions of the Pimcore Customer Management Framework may be at risk if they have users without proper access controls.