Описание
Pimcore vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Impact
Unauthorized users are able to obtain sensitive information about the system's runtime environment, features they have no permissions to access, etc.
Patches
Update to version 10.6.4 or apply this patch manually https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54.patch
Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54.patch manually.
References
https://huntr.dev/bounties/be5e4d4c-1b0b-4c01-a1fc-00533135817c/
Пакеты
Наименование
pimcore/pimcore
composer
Затронутые версииВерсия исправления
< 10.6.4
10.6.4
Связанные уязвимости
CVSS3: 6.5
nvd
больше 2 лет назад
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pimcore/pimcore prior to 10.6.4.