Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls

CAO 7.2CVE-2023-49075 · GHSA-9wwg-r3c7-4vfg · Công bố 28/11/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-49075 là lỗ hổng mức CAO (CVSS 7.2) ảnh hưởng pimcore/admin-ui-classic-bundle, admin classic bundle (pimcore).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.4%, cao hơn 73.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.2.2 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
pimcore/admin-ui-classic-bundle Packagist	`< 1.2.2`	`1.2.2`
admin classic bundle pimcore	`< 1.2.2`	`1.2.2`

Mô tả

Impact

AdminBundle\Security\PimcoreUserTwoFactorCondition introduced in v11 disable the two factor authentication for all non-admin security firewalls.

An authenticated user can access the system without having to provide the 2 factor credentials.

Patches

Apply patch https://patch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch

Workarounds

Upgrade to version 1.2.2 or apply the patch manually.

Mô tả của NVD

The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without having to provide the two factor credentials. This issue has been patched in version 1.2.2.