Patchfirst
Patchfirst
CVE-2019-10867 Public exploit EPSS 68.9%

An issue was discovered in Pimcore before 5.7.1

Summary

Pimcore versions before 5.7.1 contain a flaw in the ClassController component (bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php), where untrusted values passed in the data parameter of the /admin/class/bulk-commit endpoint are processed by the unserialize function. An attacker who holds the classes permission can send a POST request to that endpoint carrying a crafted data value to exploit the unsafe deserialization.

Official description · CVE.org

An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.

Breakdown
24.9 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (Metasploit) was available 24 days before disclosure.

  1. Public exploit codeMetasploit24 days before
  2. Disclosedday 0

See the family tree

7 related vulnerabilities in the same code over 3 years. The latest fix listed for pimcore/pimcore is 6.2.2.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. This CVECVE-2019-10867An issue was discovered in Pimcore before 5.7.14 Apr 2019
  2. same family
    CVE-2022-0262Cross-site Scripting (XSS) - Stored in pimcore/pimcore18 Jan 2022
  3. relatedMedium

    Why these are linked:

    CVE-2022-0263Unrestricted Upload of File with Dangerous Type in…18 Jan 2022
  4. same family
    CVE-2022-0348Cross-site Scripting (XSS) - Stored in pimcore/pimcore27 Jan 2022
  5. Next fix in the same packageMedium

    Why these are linked:

    • Fixed one release later10.2.10 → 10.3.1 (pimcore/pimcore)
    • Similar weakness in the same product (machine-matched)same product + CWE + description similarity
    CVE-2022-0509Cross-site Scripting (XSS) - Stored in pimcore/pimcore8 Feb 2022
  6. same family
    CVE-2022-0510Cross-site Scripting (XSS) - Reflected in pimcore/pimcore8 Feb 2022
  7. same family
    CVE-2022-0565Cross-site Scripting in pimcore/pimcore12 Feb 2022

Fixes in pimcore/pimcorePackagist package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 5.3.0CVE-2018-1405717 Aug 2018
  2. 5.3.0CVE-2018-1405817 Aug 2018
  3. 5.3.0CVE-2018-1405924 Aug 2018
  4. 5.7.1CVE-2019-108674 Apr 2019
  5. 5.7.1CVE-2019-1631714 Sep 2019
  6. 5.7.1CVE-2019-1631814 Sep 2019
  7. 6.2.2CVE-2019-1898115 Nov 2019Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: pimcore/pimcore.

Packagistpimcore/pimcoreGHSA-7hqr-j26m-gmwp

Upgrade to 5.7.1

Still affected on this line by CVE-2022-0832 (fixed in 10.3.3, a newer line); CVE-2022-1429 (fixed in 10.3.6, a newer line); CVE-2023-1578 (fixed in 10.5.19, a newer line).

Set the version to 5.7.1 or later in your composer.json.

The first fix for CVE-2019-10867.

Affected versions

If you runUpgrade to
All versions before 5.7.15.7.1

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

6 links, grouped by NVD tag

x_refsource_MISC 5

snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-173998github.com/pimcore/pimcore/commit/38a29e2f4f5f060a73974626952501cee05fda73packetstormsecurity.com/files/152667/Pimcore-Unserialize-Remote-Code-Execution.htmlrapid7.com/db/modules/exploit/multi/http/pimcore_unserialize_rceblog.certimetergroup.com/it/articolo/security/polyglot_phar_deserialization_to_rce

exploit 1

exploit-db.com/exploits/46783/
↑ ↓ chooseEnter openEsc close