GHSA-vr5f-php7-rg24
First published: Fri Feb 07 2025(Updated: )
pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore. In affected versions an error message discloses existing accounts and leads to user enumeration on the target via "Forgot password" function. No generic error message has been implemented. This issue has been addressed in version 1.7.4 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/pimcore/admin-ui-classic-bundle | <1.7.4 | 1.7.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-vr5f-php7-rg24
- https://github.com/pimcore/admin-ui-classic-bundle/pull/808
- https://github.com/pimcore/admin-ui-classic-bundle/commit/96ae555578c3b4df368092d71e07a6c4ddf8fbe9
- https://nvd.nist.gov/vuln/detail/CVE-2025-24980
- https://github.com/advisories/GHSA-vr5f-php7-rg24 (Advisory)
Frequently Asked Questions
What is the severity of GHSA-vr5f-php7-rg24?
The severity of GHSA-vr5f-php7-rg24 is classified as a medium risk due to user enumeration vulnerabilities.
How do I fix GHSA-vr5f-php7-rg24?
To fix GHSA-vr5f-php7-rg24, upgrade the Pimcore Admin Classic Bundle to version 1.7.4 or later.
What is the impact of GHSA-vr5f-php7-rg24?
The impact of GHSA-vr5f-php7-rg24 allows attackers to enumerate valid accounts through distinct error messages.
Which versions of Pimcore are affected by GHSA-vr5f-php7-rg24?
GHSA-vr5f-php7-rg24 affects all versions of the Pimcore Admin Classic Bundle prior to 1.7.4.
Is there a workaround for GHSA-vr5f-php7-rg24 if I cannot update?
A temporary workaround for GHSA-vr5f-php7-rg24 is to unify the error messages to prevent account enumeration.
- agent/weakness
- agent/source
- agent/softwarecombine
- agent/type
- agent/first-publish-date
- agent/references
- agent/event
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-vr5f-php7-rg24
- alias/CVE-2025-24980
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/description
- agent/tags
- collector/github-advisory
- package-manager/composer