CVE-2023-38708
Description
Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. A path traversal vulnerability exists in the `AssetController::importServerFilesAction`, which allows an attacker to overwrite or modify sensitive files by manipulating the pimcore_log parameter.This can lead to potential denial of service---key file overwrite. The impact of this vulnerability allows attackers to: overwrite or modify sensitive files, potentially leading to unauthorized access, privilege escalation, or disclosure of confidential information. This could also cause a denial of service (DoS) if critical system files are overwritten or deleted.
How to fix
- pimcore pimcore10.6.7 or later
- pimcore/pimcore10.6.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pimcore pimcore | v < 10.6.7 | 10.6.7 |
| pimcore/pimcorePackagist | v < 10.6.7 | 10.6.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.