CVE-2024-49370
Medium
Description
Pimcore is an open source data and experience management platform. When a PortalUserObject is connected to a PimcoreUser and "Use Pimcore Backend Password" is set to true, the change password function in Portal Profile sets the new password. Prior to Pimcore portal engine versions 4.1.7 and 3.1.16, the password is then set without hashing so it can be read by everyone. Everyone who combines PortalUser to PimcoreUsers and change passwords via profile settings could be affected. Versions 4.1.7 and 3.1.16 of the Pimcore portal engine fix the issue.
SeverityMedium
CVSS4.9
Exploit probability—
Product
Pimcore
PublishedOct 23, 2024
First seenOct 23, 2024
Weakness typeCWE-256CWE-256
How to fix
Update
- pimcore pimcore3.1.16, 4.1.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pimcore pimcore | v < 3.1.16, 4.0.0 ≤ v < 4.1.7 | 3.1.16, 4.1.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.