Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls

高 7.2CVE-2023-49075 · GHSA-9wwg-r3c7-4vfg · 28/11/2023 公開 · 17/06/2026 更新

要点

CVE-2023-49075 は pimcore/admin-ui-classic-bundle, admin classic bundle (pimcore) に影響する深刻度「高」 (CVSS 7.2) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.4%（全脆弱性の 73.1% より高い）。
対処：1.2.2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
pimcore/admin-ui-classic-bundle Packagist	`< 1.2.2`	`1.2.2`
admin classic bundle pimcore	`< 1.2.2`	`1.2.2`

概要

Impact

AdminBundle\Security\PimcoreUserTwoFactorCondition introduced in v11 disable the two factor authentication for all non-admin security firewalls.

An authenticated user can access the system without having to provide the 2 factor credentials.

Patches

Apply patch https://patch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch

Workarounds

Upgrade to version 1.2.2 or apply the patch manually.

NVD の説明

The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without having to provide the two factor credentials. This issue has been patched in version 1.2.2.