CVE-2023-32075

Katalog CVE

CVSS 4.3 · Medium EPSS 0,76%

Kerentanan Improper Input Validation pada pimcore customer management framework. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management. In `pimcore/customer-management-framework-bundle` prior to version 3.3.9, business logic errors are possible in the `Conditions` tab since the counter can be a negative number. This vulnerability is capable of the unlogic in the counter value in the Conditions tab. Users should update to version 3.3.9 to receive a patch or, as a workaround, or apply the patch manually.

Rincian

Terbit di NVD

11 Mei 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

0,76% peluang dieksploitasi; lebih tinggi dari 54,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pimcore/customer-data-framework/security/advisories/GHSA-x99j-r8vv-gwwj mitigasi · patch · advisory vendor
• https://github.com/pimcore/customer-data-framework/commit/e3f333391582d9309115e6b94e875367d0ea7163.patch patch
• https://huntr.dev/bounties/cecd7800-a996-4f3a-8689-e1c2a1e0248a/ exploit · advisory pihak ketiga
• https://github.com/pimcore/customer-data-framework/releases/tag/v3.3.9 release notes