GHSA-r2vq-p658-p274 CVE-2023-25240
SameSite Attribute vulnerability in pimCore
- Severity
- 8.8 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.97%
- Chance of exploitation in the next 30 days. Higher than 62.06% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1265 Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls
- Fix
10.5.16- Upgrade pimcore/pimcore to this version or later
Description
An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| pimcore/pimcore | < 10.5.16 |
10.5.16 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
pimcore/pimcore Packagist → 10.5.16
- composer
composer require pimcore/pimcore:^10.5.16
Severity breakdown
CVSS 3.1 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-1265: Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls
The product invokes code that is believed to be reentrant, but the code performs a call that unintentionally produces a nested invocation of the non-reentrant code.
How to prevent it
- Architecture and Design: When architecting a system that will execute untrusted code in response to events, consider executing the untrusted event handlers asynchronously (asynchronous message passing) as opposed to executing them synchronously at the time each event fires. The untrusted code should execute at the start of the next iteration of the thread's message loop. In this way, calls into non-reentrant code are strictly serialized, so that each operation completes fully before the next operation begins. Special attention must be paid to all places where type coercion may result in script execution. Performing all needed coercions at the very beginning of an operation can help reduce the chance of operations executing at unexpected junctures.
- Implementation: Make sure the code (e.g., function or class) in question is reentrant by not leveraging non-local data, not modifying its own code, and not calling other non-reentrant code.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-23rh-xw42-fq82 Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration | High | Also affects pimcore/pimcore |
| GHSA-9x44-4gxf-8c25 Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name | Critical | Also affects pimcore/pimcore |
| GHSA-w23p-wrp7-ch38 Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502) | Critical | Also affects pimcore/pimcore |
| GHSA-2mhj-fhvg-v428 Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name | High | Also affects pimcore/pimcore |
| GHSA-7p36-fq2r-4h7r Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed | High | Also affects pimcore/pimcore |
| GHSA-jwcc-gv4m-93x6 Pimcore has a CustomReports Share Bypass | High | Also affects pimcore/pimcore |
| GHSA-332x-r494-54fq Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export | Medium | Also affects pimcore/pimcore |
| GHSA-wc7j-g8wx-m2qx Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling | High | Also affects pimcore/pimcore |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor