CVE-2024-49370: Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing
Pimcore is an open source data and experience management platform. When a PortalUserObject is connected to a PimcoreUser and "Use Pimcore Backend Password" is set to true, the change password function in Portal Profile sets the new password. Prior to Pimcore portal engine versions 4.1.7 and 3.1.16, the password is then set without hashing so it can be read by everyone. Everyone who combines PortalUser to PimcoreUsers and change passwords via profile settings could be affected. Versions 4.1.7 and 3.1.16 of the Pimcore portal engine fix the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49370?
The severity of CVE-2024-49370 is classified as high due to the potential for unauthorized password changes.
How do I fix CVE-2024-49370?
To fix CVE-2024-49370, upgrade to Pimcore version 4.1.8 or later.
What versions of Pimcore are affected by CVE-2024-49370?
CVE-2024-49370 affects Pimcore versions prior to 4.1.8 and between 4.0.0 and 4.1.7.
What type of vulnerability is CVE-2024-49370?
CVE-2024-49370 is a security vulnerability that allows unauthorized password changes for connected PortalUserObjects.
Is there a workaround for CVE-2024-49370?
As a temporary measure, disable the 'Use Pimcore Backend Password' option until an upgrade can be performed.