Pimcore vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Description
Published by the National Vulnerability Database
Jul 21, 2023
Published to the GitHub Advisory Database
Jul 21, 2023
Reviewed
Jul 21, 2023
Last updated
Nov 5, 2023
Impact
Unauthorized users are able to obtain sensitive information about the system's runtime environment, features they have no permissions to access, etc.
Patches
Update to version 10.6.4 or apply this patch manually https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54.patch
Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54.patch manually.
References
https://huntr.dev/bounties/be5e4d4c-1b0b-4c01-a1fc-00533135817c/
References