Em resumo
- CVE-2021-23340 é uma vulnerabilidade ALTO (CVSS 7.1) que afeta pimcore/pimcore, pimcore (pimcore).
- Chance de exploração nos próximos 30 dias (EPSS): 1.3%, maior que 70.8% das vulnerabilidades.
- Correção: atualize para 6.8.8 ou posterior.
Description
This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename]. Since exportFile variable is not sanitized, an attacker can exploit a local file inclusion vulnerability.
NVD description
This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename]. Since exportFile variable is not sanitized, an attacker can exploit a local file inclusion vulnerability.
Mais vulnerabilidades de pimcore/pimcore
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free