In short
- CVE-2021-23340 is a HIGH (CVSS 7.1) vulnerability affecting pimcore/pimcore, pimcore (pimcore).
- Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 70.8% of all vulnerabilities.
- Fix: update to 6.8.8 or later.
Description
This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename]. Since exportFile variable is not sanitized, an attacker can exploit a local file inclusion vulnerability.
NVD description
This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename]. Since exportFile variable is not sanitized, an attacker can exploit a local file inclusion vulnerability.
More vulnerabilities in pimcore/pimcore
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free