TI-2021-06098 Aliases CVE-2021-23405 GHSA-g8jx-66p8-vcm2

SQL injection in pimcore/pimcore

MEDIUM 41CWE-89Published 2021-07-09 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class.

Why it matters now

EPSS 0.01715 77th percentileScored 2026-11-07

Fix Fixed pimcore/pimcore: 10.0.7pimcore/pimcore (Packagist): 10.0.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	pimcore/pimcore	before 10.0.7	10.0.7	Patch available	CNA
—	pimcore/pimcore (Packagist)	before 10.0.7	10.0.7	Patch available	GHSA-g8jx-66p8-vcm2

pimcore/pimcore Vendor— Affected before 10.0.7 Fixed in 10.0.7 Patch available CNA
pimcore/pimcore (Packagist) Vendor— Affected before 10.0.7 Fixed in 10.0.7 Patch available GHSA-g8jx-66p8-vcm2

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pimcore:pimcore::::::::	before 10.0.7	Vulnerable	pimcore

cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:* Versions before 10.0.7 Vulnerable ·pimcore

Remediation

Fix · CNA pimcore/pimcore Fixed in 10.0.7
Fix · GHSA-g8jx-66p8-vcm2 pimcore/pimcore (Packagist) Fixed in 10.0.7 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-23405
2026-10-03 Alias added: GHSA-g8jx-66p8-vcm2

References

Patch 1

https://github.com/pimcore/pimcore/pull/9572

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2021-23405

TI-2026-18925 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848 CVSS 3.1HIGH 8.8
TI-2026-18926 Pimcore ENV Variables and Cookie Informations are exposed in http_error_log CVSS 3.1HIGH 8.6
TI-2023-01489 SQL Injection in pimcore/pimcore CVSS 3.1HIGH 8.8
TI-2019-08091 An issue was discovered in Pimcore before 5.7.1. CVSS 3.0HIGH 8.8
TI-2023-25778 SQL Injection in Admin Grid Filter API in Pimcore CVSS 3.1HIGH 8.8
TI-2023-10682 An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code. CVSS 3.1HIGH 8.8

See all 126 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences