Vulnerability-Lookup

CVE-2023-2984 (GCVE-0-2023-2984)

Vulnerability from cvelistv5 – Published: 2023-05-30 00:00 – Updated: 2025-01-13 19:58

Title

Path Traversal: '\..\filename' in pimcore/pimcore

Summary

Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.

Severity

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-01-13 19:58 UTC

CWE

CWE-29 - Path Traversal: '\..\filename'

Assigner

@huntrdev

References

2 references

URL	Tags
https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e…
https://github.com/pimcore/pimcore/commit/e8dbc4d…

Impacted products

1 product

Vendor	Product	Version	CPE status
pimcore	pimcore/pimcore	Affected: unspecified , < 10.5.22 (custom)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:41:04.033Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-2984",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-13T19:58:45.587644Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-13T19:58:54.371Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pimcore/pimcore",
          "vendor": "pimcore",
          "versions": [
            {
              "lessThan": "10.5.22",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Path Traversal: \u0027\\..\\filename\u0027 in GitHub repository pimcore/pimcore prior to 10.5.22."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-29",
              "description": "CWE-29 Path Traversal: \u0027\\..\\filename\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-30T00:00:00.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "url": "https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191"
        },
        {
          "url": "https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed"
        }
      ],
      "source": {
        "advisory": "5df8b951-e2f1-4548-a7e3-601186e1b191",
        "discovery": "EXTERNAL"
      },
      "title": "Path Traversal: \u0027\\..\\filename\u0027 in pimcore/pimcore"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2023-2984",
    "datePublished": "2023-05-30T00:00:00.000Z",
    "dateReserved": "2023-05-30T00:00:00.000Z",
    "dateUpdated": "2025-01-13T19:58:54.371Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-2984",
      "date": "2026-09-25",
      "epss": "0.00854",
      "percentile": "0.56562"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "pimcore/pimcore",
                "vendor": "pimcore",
                "versions": [
                  {
                    "lessThan": "10.5.22",
                    "status": "affected",
                    "version": "unspecified",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "security@huntr.dev"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F6F9FCC7-1EC6-4C10-9CEC-1F8E27BD7001",
                    "versionEndExcluding": "10.5.22",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Path Traversal: \u0027\\..\\filename\u0027 in GitHub repository pimcore/pimcore prior to 10.5.22."
          }
        ],
        "id": "CVE-2023-2984",
        "lastModified": "2026-06-17T05:53:56.837",
        "metrics": {
          "cvssMetricV30": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.0"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.4,
              "source": "security@huntr.dev",
              "type": "Secondary"
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-2984",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-13T19:58:45.587644Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2023-05-30T15:15:09.700",
        "references": [
          {
            "source": "security@huntr.dev",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed"
          },
          {
            "source": "security@huntr.dev",
            "tags": [
              "Exploit",
              "Mitigation",
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Mitigation",
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191"
          }
        ],
        "sourceIdentifier": "security@huntr.dev",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-29"
              }
            ],
            "source": "security@huntr.dev",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T11:40:21+00:00",
      "cve": "CVE-2023-2984",
      "id": "CVE-2023-2984",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Path Traversal: \u0027\\..\\filename\u0027 in pimcore/pimcore",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-2984.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T06:41:04.033Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-2984",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-01-13T19:58:45.587644Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-01-13T19:58:50.372Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "pimcore/pimcore",
              "vendor": "pimcore",
              "versions": [
                {
                  "lessThan": "10.5.22",
                  "status": "affected",
                  "version": "unspecified",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Path Traversal: \u0027\\..\\filename\u0027 in GitHub repository pimcore/pimcore prior to 10.5.22."
            }
          ],
          "metrics": [
            {
              "cvssV3_0": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.0"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-29",
                  "description": "CWE-29 Path Traversal: \u0027\\..\\filename\u0027",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-05-30T00:00:00.000Z",
            "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
            "shortName": "@huntrdev"
          },
          "references": [
            {
              "url": "https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191"
            },
            {
              "url": "https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed"
            }
          ],
          "source": {
            "advisory": "5df8b951-e2f1-4548-a7e3-601186e1b191",
            "discovery": "EXTERNAL"
          },
          "title": "Path Traversal: \u0027\\..\\filename\u0027 in pimcore/pimcore"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "assignerShortName": "@huntrdev",
        "cveId": "CVE-2023-2984",
        "datePublished": "2023-05-30T00:00:00.000Z",
        "dateReserved": "2023-05-30T00:00:00.000Z",
        "dateUpdated": "2025-01-13T19:58:54.371Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

CNVD-2023-43860

Vulnerability from cnvd - Published: 2023-06-01

Title

Pimcore路径遍历漏洞（CNVD-2023-43860）

Description

Pimcore是奥地利Pimcore公司的一套开源的用于创建和管理Web应用程序的Web内容管理平台。该平台集成了Web内容管理、电子商务框架和产品信息管理等应用。 Pimcore 10.5.22之前版本存在路径遍历漏洞，该漏洞源于应用未能正确地过滤资源或文件路径中的特殊元素。攻击者可利用该漏洞通过特别设计的web请求从底层文件系统中检索任意文件。

Severity

中

Patch Name

Pimcore路径遍历漏洞（CNVD-2023-43860）的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed

Reference

https://nvd.nist.gov/vuln/detail/CVE-2023-2984

Impacted products

Name
Pimcore Pimcore <10.5.22

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-2984",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-2984"
    }
  },
  "description": "Pimcore\u662f\u5965\u5730\u5229Pimcore\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684\u7528\u4e8e\u521b\u5efa\u548c\u7ba1\u7406Web\u5e94\u7528\u7a0b\u5e8f\u7684Web\u5185\u5bb9\u7ba1\u7406\u5e73\u53f0\u3002\u8be5\u5e73\u53f0\u96c6\u6210\u4e86Web\u5185\u5bb9\u7ba1\u7406\u3001\u7535\u5b50\u5546\u52a1\u6846\u67b6\u548c\u4ea7\u54c1\u4fe1\u606f\u7ba1\u7406\u7b49\u5e94\u7528\u3002\n\nPimcore 10.5.22\u4e4b\u524d\u7248\u672c\u5b58\u5728\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5e94\u7528\u672a\u80fd\u6b63\u786e\u5730\u8fc7\u6ee4\u8d44\u6e90\u6216\u6587\u4ef6\u8def\u5f84\u4e2d\u7684\u7279\u6b8a\u5143\u7d20\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u7279\u522b\u8bbe\u8ba1\u7684web\u8bf7\u6c42\u4ece\u5e95\u5c42\u6587\u4ef6\u7cfb\u7edf\u4e2d\u68c0\u7d22\u4efb\u610f\u6587\u4ef6\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2023-43860",
  "openTime": "2023-06-01",
  "patchDescription": "Pimcore\u662f\u5965\u5730\u5229Pimcore\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684\u7528\u4e8e\u521b\u5efa\u548c\u7ba1\u7406Web\u5e94\u7528\u7a0b\u5e8f\u7684Web\u5185\u5bb9\u7ba1\u7406\u5e73\u53f0\u3002\u8be5\u5e73\u53f0\u96c6\u6210\u4e86Web\u5185\u5bb9\u7ba1\u7406\u3001\u7535\u5b50\u5546\u52a1\u6846\u67b6\u548c\u4ea7\u54c1\u4fe1\u606f\u7ba1\u7406\u7b49\u5e94\u7528\u3002\r\n\r\nPimcore 10.5.22\u4e4b\u524d\u7248\u672c\u5b58\u5728\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5e94\u7528\u672a\u80fd\u6b63\u786e\u5730\u8fc7\u6ee4\u8d44\u6e90\u6216\u6587\u4ef6\u8def\u5f84\u4e2d\u7684\u7279\u6b8a\u5143\u7d20\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u7279\u522b\u8bbe\u8ba1\u7684web\u8bf7\u6c42\u4ece\u5e95\u5c42\u6587\u4ef6\u7cfb\u7edf\u4e2d\u68c0\u7d22\u4efb\u610f\u6587\u4ef6\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Pimcore\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\uff08CNVD-2023-43860\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Pimcore Pimcore \u003c10.5.22"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2023-2984",
  "serverity": "\u4e2d",
  "submitTime": "2023-05-31",
  "title": "Pimcore\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\uff08CNVD-2023-43860\uff09"
}

FKIE_CVE-2023-2984

Vulnerability from fkie_nvd - Published: 2023-05-30 15:15 - Updated: 2026-06-17 05:53

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.

References

URL	Tags
security@huntr.dev	https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed	Patch
security@huntr.dev	https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191	Exploit, Mitigation, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed	Patch
af854a3a-2127-422b-91ae-364da2661108	https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191	Exploit, Mitigation, Patch, Third Party Advisory

Impacted products

	Vendor	Product	Version
	pimcore	pimcore	*
	microsoft	windows	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "pimcore/pimcore",
          "vendor": "pimcore",
          "versions": [
            {
              "lessThan": "10.5.22",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "security@huntr.dev"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F6F9FCC7-1EC6-4C10-9CEC-1F8E27BD7001",
              "versionEndExcluding": "10.5.22",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Path Traversal: \u0027\\..\\filename\u0027 in GitHub repository pimcore/pimcore prior to 10.5.22."
    }
  ],
  "id": "CVE-2023-2984",
  "lastModified": "2026-06-17T05:53:56.837",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4,
        "source": "security@huntr.dev",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-2984",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-01-13T19:58:45.587644Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2023-05-30T15:15:09.700",
  "references": [
    {
      "source": "security@huntr.dev",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed"
    },
    {
      "source": "security@huntr.dev",
      "tags": [
        "Exploit",
        "Mitigation",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Mitigation",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191"
    }
  ],
  "sourceIdentifier": "security@huntr.dev",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-29"
        }
      ],
      "source": "security@huntr.dev",
      "type": "Secondary"
    }
  ]
}

GHSA-46G3-F9R8-XJ4V

Vulnerability from github – Published: 2023-06-06 01:51 – Updated: 2023-06-06 01:51

Summary

Pimcore vulnerable to Pre-Auth Path Traversal in pimcore_log parameter

Details

Impact

A path traversal vulnerability exists in the CMS, which allows an attacker to overwrite or modify sensitive files by manipulating the pimcore_log parameter.This can lead to potential denial of service---key file overwrite.

The impact of this vulnerability allows attackers to:

Overwrite or modify sensitive files, potentially leading to unauthorized access, privilege escalation, or disclosure of confidential information.
Tamper with system settings by modifying key files, such as the hosts file in Windows or configuration files for other services.
Cause a denial of service (DoS) if critical system files are overwritten or deleted.

The consequences of exploiting this vulnerability can be detrimental to the confidentiality, integrity, and availability of the affected system. It's crucial to address this vulnerability to protect sensitive data and ensure the proper functioning of the system.

Patches

Update to version 10.5.22 or apply this patch manually https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed.patch

Workarounds

Apply patch https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed.patch manually.

References

https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191/

Severity

6.3 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "pimcore/pimcore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.5.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-2984"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-29"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-06-06T01:51:34Z",
    "nvd_published_at": "2023-05-30T15:15:09Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nA path traversal vulnerability exists in the CMS, which allows an attacker to overwrite or modify sensitive files by manipulating the `pimcore_log` parameter.This can lead to potential denial of service---key file overwrite.\n\nThe impact of this vulnerability allows attackers to:\n\n- Overwrite or modify sensitive files, potentially leading to unauthorized access, privilege escalation, or disclosure of confidential information.\n\n- Tamper with system settings by modifying key files, such as the hosts file in Windows or configuration files for other services.\n\n- Cause a denial of service (DoS) if critical system files are overwritten or deleted.\n\nThe consequences of exploiting this vulnerability can be detrimental to the confidentiality, integrity, and availability of the affected system. It\u0027s crucial to address this vulnerability to protect sensitive data and ensure the proper functioning of the system.\n\n### Patches\nUpdate to version 10.5.22 or apply this patch manually https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed.patch\n\n### Workarounds\nApply patch https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed.patch manually.\n\n### References\nhttps://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191/",
  "id": "GHSA-46g3-f9r8-xj4v",
  "modified": "2023-06-06T01:51:34Z",
  "published": "2023-06-06T01:51:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-46g3-f9r8-xj4v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2984"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pimcore/pimcore"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pimcore vulnerable to Pre-Auth Path Traversal in pimcore_log parameter"
}

GSD-2023-2984

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.

Aliases

CVE-2023-2984

Aliases

CVE-2023-2984

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-2984",
    "id": "GSD-2023-2984"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-2984"
      ],
      "details": "Path Traversal: \u0027\\..\\filename\u0027 in GitHub repository pimcore/pimcore prior to 10.5.22.",
      "id": "GSD-2023-2984",
      "modified": "2023-12-13T01:20:31.496918Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@huntr.dev",
        "ID": "CVE-2023-2984",
        "STATE": "PUBLIC",
        "TITLE": "Path Traversal: \u0027\\..\\filename\u0027 in pimcore/pimcore"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "pimcore/pimcore",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_value": "10.5.22"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "pimcore"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Path Traversal: \u0027\\..\\filename\u0027 in GitHub repository pimcore/pimcore prior to 10.5.22."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.0"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-29 Path Traversal: \u0027\\..\\filename\u0027"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191",
            "refsource": "CONFIRM",
            "url": "https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191"
          },
          {
            "name": "https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed",
            "refsource": "MISC",
            "url": "https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed"
          }
        ]
      },
      "source": {
        "advisory": "5df8b951-e2f1-4548-a7e3-601186e1b191",
        "discovery": "EXTERNAL"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c10.5.22",
          "affected_versions": "All versions before 10.5.22",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-29",
            "CWE-937"
          ],
          "date": "2023-06-05",
          "description": "Path Traversal: \u0027\\..\\filename\u0027 in GitHub repository pimcore/pimcore prior to 10.5.22.",
          "fixed_versions": [
            "10.5.22"
          ],
          "identifier": "CVE-2023-2984",
          "identifiers": [
            "CVE-2023-2984"
          ],
          "not_impacted": "All versions starting from 10.5.22",
          "package_slug": "packagist/pimcore/pimcore",
          "pubdate": "2023-05-30",
          "solution": "Upgrade to version 10.5.22 or above.",
          "title": "Path Traversal: \u0027\\..\\filename\u0027",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2023-2984",
            "https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191",
            "https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed"
          ],
          "uuid": "ab0984df-2e7a-4c55-a15b-54315e2cbf01"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "10.5.22",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2023-2984"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Path Traversal: \u0027\\..\\filename\u0027 in GitHub repository pimcore/pimcore prior to 10.5.22."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-29"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191",
              "refsource": "CONFIRM",
              "tags": [
                "Exploit",
                "Mitigation",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191"
            },
            {
              "name": "https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed",
              "refsource": "MISC",
              "tags": [
                "Patch"
              ],
              "url": "https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-06-05T18:16Z",
      "publishedDate": "2023-05-30T15:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2023-2984 (GCVE-0-2023-2984)

CNVD-2023-43860

FKIE_CVE-2023-2984

GHSA-46G3-F9R8-XJ4V

Impact

Patches

Workarounds

References

GSD-2023-2984

Tags

Sightings

Nomenclature

Related by attack behaviour