{"id":"CVE-2023-2983","published":"2023-05-30T00:00:00Z","modified":"2025-01-10T20:52:19Z","title":"Privilege Defined With Unsafe Actions in pimcore/pimcore","vendor":"pimcore","product":"pimcore/pimcore","tier":"tail","description":{"text":"Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00919,"percentile":0.60213,"provenance":"source"},"cwes":[{"id":"CWE-267","name":"Privilege Defined With Unsafe Actions"}],"references":[{"url":"https://huntr.dev/bounties/6b2f33d3-2fd0-4d2d-ad7b-2c1e2417eeb1","tags":[]},{"url":"https://github.com/pimcore/pimcore/commit/c8f37b19c99cd82e4e558857d3e4d5476ea7228a","tags":[]}],"priority":{"score":16.6,"factors":[{"name":"EPSS percentile","points":12.04},{"name":"CVSS severity","points":4.55}]},"vendorSlug":"pimcore","affectedVersions":[{"vendor":"pimcore","product":"pimcore/pimcore","versions":[">= unspecified, < 10.5.23"]}],"affected":[{"ecosystem":"Packagist","package":"pimcore/pimcore","vulnerableRanges":["<10.5.23"],"patched":["10.5.23"],"from":["GHSA-m4mv-rmr7-h5f5"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1841","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-pimcore-cve-2019-18985","parents":[{"from":"CVE-2019-18985","to":"CVE-2023-2983","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["bundles/AdminBundle/Controller/Admin/UserController.php"],"commits":["https://github.com/pimcore/pimcore/commit/9f2d075243a8392c114d9a8028858b9faf041e2d","https://github.com/pimcore/pimcore/commit/c8f37b19c99cd82e4e558857d3e4d5476ea7228a"],"basis":"rarely changed file"}]},{"from":"CVE-2023-23937","to":"CVE-2023-2983","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["bundles/AdminBundle/Controller/Admin/UserController.php"],"commits":["https://github.com/pimcore/pimcore/commit/75a448ef8ac74424cf4e723afeb6d05f9eed872f","https://github.com/pimcore/pimcore/commit/c8f37b19c99cd82e4e558857d3e4d5476ea7228a"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2023-30850","published":"2023-04-27","fixed":"10.5.21","kev":false},{"cve":"CVE-2023-30852","published":"2023-04-27","fixed":"10.5.21","kev":false},{"cve":"CVE-2023-2984","published":"2023-05-30","fixed":"10.5.22","kev":false,"link":{"from":"CVE-2023-2984","to":"CVE-2023-2983","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:pimcore/pimcore","fromFixed":"10.5.22","toFixed":"10.5.23","daysApart":0}]}},{"cve":"CVE-2023-2983","published":"2023-05-30","fixed":"10.5.23","kev":false},{"cve":"CVE-2023-3673","published":"2023-07-14","fixed":"10.5.24","kev":false,"link":{"from":"CVE-2023-2983","to":"CVE-2023-3673","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:pimcore/pimcore","fromFixed":"10.5.23","toFixed":"10.5.24","daysApart":45}]}},{"cve":"CVE-2023-3819","published":"2023-07-21","fixed":"10.6.4","kev":false},{"cve":"CVE-2023-3820","published":"2023-07-21","fixed":"10.6.4","kev":false}],"package":"Packagist:pimcore/pimcore"}}