CVE-2023-42817
Description
Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user. The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box. This issue has been patched in commit `abd77392` which is included in release 1.1.2. Users are advised to update to version 1.1.2 or apply the patch manually.
How to fix
- pimcore admin_classic_bundle1.1.2 or later
- pimcore/admin-ui-classic-bundle1.1.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pimcore admin_classic_bundle | v < 1.1.2 | 1.1.2 |
| pimcore/admin-ui-classic-bundlePackagist | v < 1.1.2 | 1.1.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.