MediumGHSA-3rfr-mpfj-2jwqCVE-2024-24822

Pimcore Admin Classic Bundle permissions are not getting checked when working with tags

Published 7 Feb 2024 · Updated 10 Sept 2026

Affected package

Affected: <1.3.3
Fixed in: 1.3.3

Update to the fixed version for your release line, for example:composer require pimcore/admin-ui-classic-bundle:^1.3.3

Details

Impact

You can create, delete etc. tags without having the permission to do so. This vulnerability allows an attacker to perform broken access control and add tags to admin panel and add dumy data. One can do this as intruder and add text parameters with random numbers and this will effect integrity and availability.

Patches

Available in version 1.3.3.

Workarounds

Apply this pull request manually: https://github.com/pimcore/admin-ui-classic-bundle/pull/412

References

Is GHSA-3rfr-mpfj-2jwq in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected pimcore/admin-ui-classic-bundle, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.