Pimcore Admin Classic Bundle allows user enumeration
Published 7 Feb 2025 · Updated 11 Feb 2025
Affected package
- Affected
- <1.7.4
- Fixed in
- 1.7.4
composer require pimcore/admin-ui-classic-bundle:^1.7.4Details
pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore. In affected versions an error message discloses existing accounts and leads to user enumeration on the target via "Forgot password" function. No generic error message has been implemented. This issue has been addressed in version 1.7.4 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Is GHSA-vr5f-php7-rg24 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected pimcore/admin-ui-classic-bundle, and gives you the command that fixes it.
References
- Linkgithub.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-vr5f-php7-rg24
- Advisorynvd.nist.gov/vuln/detail/CVE-2025-24980
- Linkgithub.com/pimcore/admin-ui-classic-bundle/pull/808
- Linkgithub.com/pimcore/admin-ui-classic-bundle/commit/96ae555578c3b4df368092d71e07a6c4ddf8fbe9
- Packagegithub.com/pimcore/admin-ui-classic-bundle
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.