Pimcore: >> Pimcore >> 5.7.3 Security Vulnerabilities
pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection that can lead in data leakage. The vulnerability can be exploited via 'id', 'storeId', 'pageSize' and 'tables' parameters, using a payload for trigger a time based or error based sql injection.
CVSS Score
6.5
EPSS Score
0.0
Published
2019-11-18
Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users.
CVSS Score
7.5
EPSS Score
0.0
Published
2019-11-15
Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.
CVSS Score
9.8
EPSS Score
0.0
Published
2019-11-15
Pimcore before 6.2.2 lacks brute force protection for the 2FA token.
CVSS Score
9.8
EPSS Score
0.0
Published
2019-11-15
Page 11