MediumGHSA-6f58-j323-6472CVE-2023-5844

pimcore/admin-ui-classic-bundle Unverified Password Change

Published 31 Oct 2023 · Updated 10 Nov 2025

Affected package

Affected: <1.2.0-RC1
Fixed in: 1.2.0-RC1

Update to the fixed version for your release line, for example:composer require pimcore/admin-ui-classic-bundle:^1.2.0-RC1

Details

Impact

As old password can be set as new password , it is considered as password policy violation.

Pimcore is not enforcing strict password policy which allow attacker to set old password as new password

Proof of Concept 1. Go to Admin link 2. login and click on -> "User | My Profile". 3. Go to change password now put old password as new password and click save.

Patches

https://github.com/pimcore/admin-ui-classic-bundle/commit/498ac77e54541177be27b0c710e387c47b3836ea.patch

Workarounds

Update to version 1.2.0 or apply this patches manually https://github.com/pimcore/admin-ui-classic-bundle/commit/498ac77e54541177be27b0c710e387c47b3836ea.patch

References

https://huntr.com/bounties/b031199d-192a-46e5-8c02-f7284ad74021/

Is GHSA-6f58-j323-6472 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected pimcore/admin-ui-classic-bundle, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.