{"id":"CVE-2018-14057","published":"2018-08-17T18:00:00Z","modified":"2024-08-05T09:21:40Z","title":"Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging…","vendor":null,"product":null,"tier":"tail","description":{"text":"Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-csrf-token anti-CSRF token only in the \"Settings > Users / Roles\" function.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03295,"percentile":0.88456,"provenance":"source"},"cwes":[],"references":[{"url":"http://seclists.org/fulldisclosure/2018/Aug/13","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://packetstormsecurity.com/files/148954/Pimcore-5.2.3-CSRF-Cross-Site-Scripting-SQL-Injection.html","tags":["x_refsource_MISC"]},{"url":"https://www.sec-consult.com/en/blog/advisories/sql-injection-xss-csrf-vulnerabilities-in-pimcore-software/","tags":["x_refsource_MISC"]},{"url":"https://www.exploit-db.com/exploits/45208/","tags":["exploit","x_refsource_EXPLOIT-DB"]}],"priority":{"score":22.7,"factors":[{"name":"EPSS percentile","points":17.69},{"name":"Public exploit code","points":5.0}]},"exploitSources":{"exploitdb":{"count":3,"earliest":"2018-08-16"},"first":{"date":"2018-08-16","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/45208"},"provenance":"source"},"affected":[{"ecosystem":"Packagist","package":"pimcore/pimcore","vulnerableRanges":["<5.3.0"],"patched":["5.3.0"],"from":["GHSA-gmff-vcv6-mmfr"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-3975","exploited":false,"provenance":"source"},"exploits":[{"id":45208,"url":"https://www.exploit-db.com/exploits/45208","title":"Pimcore 5.2.3 - SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery","date":"2018-08-16","verified":false,"provenance":"source"},{"id":45208,"url":"https://www.exploit-db.com/exploits/45208","title":"Pimcore 5.2.3 - SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery","date":"2018-08-16","verified":false,"provenance":"source"},{"id":45208,"url":"https://www.exploit-db.com/exploits/45208","title":"Pimcore 5.2.3 - SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery","date":"2018-08-16","verified":false,"provenance":"source"}],"exploitRefs":["https://www.exploit-db.com/exploits/45208/","http://packetstormsecurity.com/files/148954/Pimcore-5.2.3-CSRF-Cross-Site-Scripting-SQL-Injection.html","https://www.exploit-db.com/exploits/45208"]}