Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
Priority MEDIUM 40CWE-308Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without having to provide the two factor credentials. This issue has been patched in version 1.2.2.
Why it matters now
EPSS 0.01437 73rd percentileScored 2026-11-07
Fix Fixed admin-ui-classic-bundle (pimcore): 1.2.2pimcore/admin-ui-classic-bundle (Packagist): 1.2.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pimcore | admin-ui-classic-bundle | before 1.2.2 | 1.2.2 | Patch available | CNA |
| — | pimcore/admin-ui-classic-bundle (Packagist) | before 1.2.2 | 1.2.2 | Patch available | GHSA-9wwg-r3c7-4vfg |
- admin-ui-classic-bundle Vendorpimcore Affected before 1.2.2 Fixed in 1.2.2 Patch available CNA
- pimcore/admin-ui-classic-bundle (Packagist) Vendor— Affected before 1.2.2 Fixed in 1.2.2 Patch available GHSA-9wwg-r3c7-4vfg
Remediation
- Fix · CNA admin-ui-classic-bundle (pimcore) Fixed in 1.2.2
- Fix · GHSA-9wwg-r3c7-4vfg pimcore/admin-ui-classic-bundle (Packagist) Fixed in 1.2.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-49075
- 2026-10-03 Alias added: GHSA-9wwg-r3c7-4vfg
References
Patch 4
- https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-9wwg-r3c7-4vfg
- https://github.com/pimcore/admin-ui-classic-bundle/pull/345
- https://github.com/pimcore/admin-ui-classic-bundle/commit/e412b0597830ae564a604e2579eb40e76f7f0628
- https://patch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch
More pimcore Admin Classic Bundle vulnerabilities
- TI-2024-15667 Pimcore Admin Classic Bundle host header injection in the password reset CVSS 3.1HIGH 8.8
- TI-2024-16853 Pimcore Host Header Injection in user invitation link CVSS 3.1CRITICAL 9.3
- TI-2024-15665 Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip CVSS 3.1HIGH 8.8
- TI-2025-18658 Pimcore Admin Classic Bundle allows user enumeration CVSS 4.0MEDIUM 6.9
- TI-2023-05380 Unverified Password Change in pimcore/admin-ui-classic-bundle CVSS 3.1HIGH 7.2
- TI-2023-25777 Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle CVSS 3.1MEDIUM 5.3
Sources
- CVE-2023-49075 · CVE Program
- CVE-2023-49075 · NVD
- FIRST EPSS
- GHSA-9wwg-r3c7-4vfg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences