pimcore · pimcore/pimcore
A SQL injection flaw exists in the pimcore/pimcore product from the pimcore vendor, in versions prior to 10.5.19. An attacker with local access and high-privilege credentials, requiring no user interaction, can exploit it to read, modify, or disrupt data in the database.
SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19.
Disclosed on 22 Mar 2023. No public exploit code or confirmed exploitation is recorded.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: pimcore/pimcore.
Upgrade to 10.5.19 or later
Fixes this CVE and 3 other known vulnerabilities in this package (CVE-2019-10867, CVE-2022-0832, +1).
Set the version to 10.5.19 or later in your composer.json.
The first fix for CVE-2023-1578.
| If you run | Upgrade to |
|---|---|
| All versions before 10.5.19 | 10.5.19 |
“Up to” means the second version is the fix and is not affected.