Pimcore Demo Allows GraphQL Introspection

MEDIO 6.5CVE-2023-5192 · GHSA-p76j-h4m8-hx5c · Published 27/09/2023 · updated 17/06/2026

En resumen

CVE-2023-5192 es una vulnerabilidad MEDIO (CVSS 6.5) que afecta a pimcore/demo, core (pimcore).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.99%, mayor que el 62.5% de las vulnerabilidades.
Solución: actualizar a 10.3.0 o posterior.

Package	Affected versions	Patched versions
pimcore/demo Packagist	`< 10.3.0`	`10.3.0`
core pimcore	`< 10.3.0`	`10.3.0`

Description

Introspection is enabled on demo.pimcore.fun. The demo site has graphql as a feature for users, but allows users to run instropection queries, which presents a potential schema information disclosure vulnerability.

NVD description

Excessive Data Query Operations in a Large Data Table in GitHub repository pimcore/demo prior to 10.3.0.

References

nvd.nist.gov/vuln/detail/CVE-2023-5192 · ADVISORY
pimcore/demo#437 · WEB
pimcore/demo commit a2a7ff3 · WEB
pimcore/demo · PACKAGE
huntr.dev/bounties/65c954f2-79c3-4672-8846-a3035e7a1db7 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free