CVE-2024-24822: Pimcore Admin Classic Bundle permissions are not getting checked when working with tags
Impact You can create, delete etc. tags without having the permission to do so. This vulnerability allows an attacker to perform broken access control and add tags to admin panel and add dumy data. One can do this as intruder and add text parameters with random numbers and this will effect integrity and availability.
Patches Available in version 1.3.3.
Workarounds Apply this pull request manually: https://github.com/pimcore/admin-ui-classic-bundle/pull/412
References -
Other sources
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. tags without having the permission to do so. A fix is available in version 1.3.3. As a workaround, one may apply the patch manually.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/pimcore/admin-ui-classic-bundleto a version that resolves this vulnerability.Fixed in 1.3.3 - Upgrade
Upgrade
pimcore/admin-ui-classic-bundleto a version that resolves this vulnerability.Fixed in 1.3.3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-24822?
CVE-2024-24822 is classified as a medium severity vulnerability due to broken access control in the affected software.
How do I fix CVE-2024-24822?
To fix CVE-2024-24822, upgrade to the latest version of the Pimcore Admin UI Classic Bundle beyond 1.3.3.
What are the potential impacts of CVE-2024-24822?
CVE-2024-24822 allows unauthorized users to create and delete tags, leading to possible data manipulation.
Which versions are affected by CVE-2024-24822?
CVE-2024-24822 affects Pimcore Admin UI Classic Bundle version 1.3.3 and earlier.
Who is vulnerable to CVE-2024-24822?
Any users of the Pimcore Admin UI Classic Bundle versions up to 1.3.3 are vulnerable to CVE-2024-24822.