7.1
Élevée
CVE-2021-23340 This affects the package pimcore/pimcore before 6.8.8
Description
This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename]. Since exportFile variable is not sanitized, an attacker can exploit a local file inclusion vulnerability.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| pimcore/pimcore 6.8 | premières → < 6.8.8 | 6.8.8 |
Autres CVE de pimcore/pimcore
Les 4 CVE de pimcore/pimcore →
CVE-2021-23405
This affects the package pimcore/pimcore before 10.0.7
8.3
Élevée
CVE-2020-7759
The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification…
6.5
Moyenne
CVE-2019-10763
pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection
Non notée