7.1
High
CVE-2021-23340 This affects the package pimcore/pimcore before 6.8.8
Description
This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename]. Since exportFile variable is not sanitized, an attacker can exploit a local file inclusion vulnerability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| pimcore/pimcore 6.8 | earliest → < 6.8.8 | 6.8.8 |
Other CVEs of pimcore/pimcore
The 4 CVEs of pimcore/pimcore →
CVE-2021-23405
This affects the package pimcore/pimcore before 10.0.7
8.3
High
CVE-2020-7759
The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification…
6.5
Medium
CVE-2019-10763
pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection
Not rated