Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
Published 27 Nov 2023 · Updated 16 Feb 2024
Affected package
- Affected
- <1.2.2
- Fixed in
- 1.2.2
composer require pimcore/admin-ui-classic-bundle:^1.2.2Details
Impact
AdminBundle\Security\PimcoreUserTwoFactorCondition introduced in v11 disable the two factor authentication for all non-admin security firewalls.
An authenticated user can access the system without having to provide the 2 factor credentials.
Patches
Apply patch https://patch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch
Workarounds
Upgrade to version 1.2.2 or apply the patch manually.
Is GHSA-9wwg-r3c7-4vfg in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected pimcore/admin-ui-classic-bundle, and gives you the command that fixes it.
References
- Linkgithub.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-9wwg-r3c7-4vfg
- Advisorynvd.nist.gov/vuln/detail/CVE-2023-49075
- Linkgithub.com/pimcore/admin-ui-classic-bundle/pull/345
- Linkgithub.com/pimcore/admin-ui-classic-bundle/commit/e412b0597830ae564a604e2579eb40e76f7f0628
- Packagegithub.com/pimcore/admin-ui-classic-bundle
- Linkpatch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.