CVE-2023-49075

Katalog CVE

CVSS 7.2 · High EPSS 1,4%

Kerentanan Use of Single-factor Authentication pada pimcore admin classic bundle. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without having to provide the two factor credentials. This issue has been patched in version 1.2.2.

Rincian

Terbit di NVD

28 November 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-308: Use of Single-factor Authentication

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 72,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pimcore/admin-ui-classic-bundle/pull/345 patch · advisory vendor · url repurposed
• https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-9wwg-r3c7-4vfg patch · advisory vendor
• https://patch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch patch · advisory vendor
• https://github.com/pimcore/admin-ui-classic-bundle/commit/e412b0597830ae564a604e2579eb40e76f7f0628 patch