| Package | Affected versions | Patched versions |
|---|---|---|
| pimcore/admin-ui-classic-bundle | < 1.2.2 | 1.2.2 |
| admin classic bundle | < 1.2.2 | 1.2.2 |
AdminBundle\Security\PimcoreUserTwoFactorCondition introduced in v11 disable the two factor authentication for all non-admin security firewalls.
An authenticated user can access the system without having to provide the 2 factor credentials.
Apply patch https://patch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch
Upgrade to version 1.2.2 or apply the patch manually.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free