Read the docs
TI-2024-15667 Aliases CVE-2024-23648GHSA-mrqg-mwh7-q94j

Pimcore Admin Classic Bundle host header injection in the password reset

Priority HIGH 77CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The password reset functionality sends to the the user requesting a password change an email containing an URL to reset its password. The URL sent contains a unique token, valid during 24 hours, allowing the user to reset its password. This token is highly sensitive ; as an attacker able to retrieve it would be able to resets the user's password. Prior to version 1.2.3, the reset-password URL is crafted using the "Host" HTTP header of the request sent to request a password reset. This way, an external attacker could send password requests for users, but specify a "Host" header of a website that they control. If the user receiving the mail clicks on the link, the attacker would retrieve the reset token of the victim and perform account takeover. Version 1.2.3 fixes this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00827 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed admin-ui-classic-bundle (pimcore): 1.2.3pimcore/admin-ui-classic-bundle (Packagist): 1.2.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pimcoreadmin-ui-classic-bundlebefore 1.2.31.2.3Patch availableCNA
—pimcore/admin-ui-classic-bundle (Packagist)before 1.2.31.2.3Patch availableGHSA-mrqg-mwh7-q94j
  • admin-ui-classic-bundle Vendorpimcore Affected before 1.2.3 Fixed in 1.2.3 Patch available CNA
  • pimcore/admin-ui-classic-bundle (Packagist) Vendor— Affected before 1.2.3 Fixed in 1.2.3 Patch available GHSA-mrqg-mwh7-q94j

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pimcore:admin_classic_bundle:*:*:*:*:*:pimcore:*:*before 1.2.3Vulnerablepimcore
  • cpe:2.3:a:pimcore:admin_classic_bundle:*:*:*:*:*:pimcore:*:* Versions before 1.2.3 Vulnerable ·pimcore

Remediation

  • Fix · CNA admin-ui-classic-bundle (pimcore) Fixed in 1.2.3
  • Fix · GHSA-mrqg-mwh7-q94j pimcore/admin-ui-classic-bundle (Packagist) Fixed in 1.2.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-23648
  2. 2026-10-03 Alias added: GHSA-mrqg-mwh7-q94j

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2024-16853 Pimcore Host Header Injection in user invitation link CVSS 3.1CRITICAL 9.3
  • TI-2024-15665 Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip CVSS 3.1HIGH 8.8
  • TI-2025-18658 Pimcore Admin Classic Bundle allows user enumeration CVSS 4.0MEDIUM 6.9
  • TI-2023-05380 Unverified Password Change in pimcore/admin-ui-classic-bundle CVSS 3.1HIGH 7.2
  • TI-2023-25777 Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle CVSS 3.1MEDIUM 5.3
  • TI-2024-27461 Pimcore vulnerable to disclosure of system and database information behind /admin firewall CVSS 3.1MEDIUM 6.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences