pimcore/admin-ui-classic-bundle vulnerabilities

Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter

Affected

>=2.0.0-RC1 <2.3.6 · <1.7.18

Fixed in

1.7.18, 2.3.6

Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing

Affected

>=2.0.0-RC1 <2.2.3 · <1.7.16

Fixed in

1.7.16, 2.2.3

Pimcore's Admin Classic Bundle allows HTML Injection

Affected

<1.7.6

Fixed in

1.7.6

Pimcore Admin Classic Bundle allows user enumeration

Affected

<1.7.4

Fixed in

1.7.4

Pimcore includes vulnerable PHPOffice/PhpSpreadsheet

Affected

<1.3.11 · >=1.4.0 <1.4.7 · >=1.5.0 <1.5.4

Fixed in

1.3.11, 1.4.7, 1.5.4

Pimcore vulnerable to disclosure of system and database information behind /admin firewall

Affected

<1.5.2

Fixed in

1.5.2

Vulnerable embedded jQuery Version

Affected

<1.4.3

Fixed in

1.4.3

Pimcore Host Header Injection in user invitation link

Affected

<1.3.4

Fixed in

1.3.4

Pimcore Admin Classic Bundle permissions are not getting checked when working with tags

Affected

<1.3.3

Fixed in

1.3.3

Host header injection in the password reset

Affected

<1.2.3

Fixed in

1.2.3

SQL Injection in Admin download files as zip

Affected

>=1.0.0 <1.3.2

Fixed in

1.3.2

Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls

Affected

<1.2.2

Fixed in

1.2.2

pimcore/admin-ui-classic-bundle Full Path Disclosure via re-export document

Affected

<1.2.1

Fixed in

1.2.1

Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews

Affected

<1.2.0

Fixed in

1.2.0

pimcore/admin-ui-classic-bundle Unverified Password Change

Affected

<1.2.0-RC1

Fixed in

1.2.0-RC1

pimcore/admin-ui-classic-bundle Cross-site Scripting vulnerability in Translations

Affected

<1.1.2

Fixed in

1.1.2

Pimcore admin UI vulnerable to Cross-site Scripting in 2 factor authentication setup page

Affected

<1.0.3

Fixed in

1.0.3