pimcore

Records172All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical8CVSS 9.0–10.0

CVSS high62CVSS 7.0–8.9

Exploited now

pimcore records in CISA KEV

No pimcore vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Pimcore 127 records HIGH Admin Classic Bundle 14 records HIGH Customer Management Framework 9 records HIGH Core 1 record MEDIUM Data-hub 1 record LOW E-commerce Framework 1 record LOW Perspective Editor 1 record LOW Web2print Tools 1 record MEDIUM

Records

9 records in Customer Management Framework · all components

TI-2023-02580 CVE-2023-2756 · GHSA-25fx-3c2q-cq46

SQL Injection in pimcore/customer-data-framework

HIGH 67

SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00935 Published 2023-05-17 Fixed in 3.3.10 CWE-89

TI-2023-02458 CVE-2023-2629 · GHSA-mq3x-qgwx-3rfw

Improper Neutralization of Formula Elements in a CSV File in pimcore/customer-data-framework

HIGH 67

Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00406 Published 2023-05-10 Fixed in 3.3.9 CWE-1236

TI-2024-14388 CVE-2024-21667 · GHSA-g273-wppx-82w4

Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts

MEDIUM 62

pimcore/customer-data-framework is the Customer Management Framework for management of customer data within Pimcore.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00588 Published 2024-01-11 Fixed in 4.0.6 CWE-284

TI-2024-14387 CVE-2024-21666 · GHSA-c38c-c8mh-vq68

Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list

MEDIUM 62

The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management, segmentation, personalization and marketing automation.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00564 Published 2024-01-11 Fixed in 4.0.6 CWE-284

TI-2023-03336 CVE-2023-3574 · GHSA-vx35-f379-4q49

Improper Authorization in pimcore/customer-data-framework

MEDIUM 62

Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00538 Published 2023-07-10 Fixed in 3.4.1 CWE-285

TI-2023-03835 CVE-2023-4145 · GHSA-735f-w79p-282x

Cross-site Scripting (XSS) - Stored in pimcore/customer-data-framework

MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00612 Published 2023-08-03 Fixed in 3.4.2 CWE-79

TI-2023-15379 CVE-2023-32075 · GHSA-x99j-r8vv-gwwj

Pimcore vulnerable to Business Logic Errors in Customer automation rules

MEDIUM 53

The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00763 Published 2023-05-11 Fixed in 3.3.9 CWE-20

TI-2021-11858 CVE-2021-31867 · GHSA-8xf7-qvx6-fc7h

Pimcore Customer Data Framework 'SegmentAssignmentController.php' Blind SQL Injection

LOW 35

Pimcore Customer Data Framework version 3.0.0 and earlier suffers from a Boolean-based blind SQL injection issue in the $id parameter of the SegmentAssignmentController.php component of the application.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01225 Published 2021-08-04 No fix listed CWE-89

TI-2023-02700 CVE-2023-2881 · GHSA-j65r-g7q2-f8v3

Storing Passwords in a Recoverable Format in pimcore/customer-data-framework

LOW 23

Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00547 Published 2023-05-25 Fixed in 3.3.10 CWE-257

Open these records in search →

Critical	8
High	62
Medium	101
Low	1
No CVSS	0