Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:composer/pimcore/pimcore@11.1.1
Typecomposer
Namespacepimcore
Namepimcore
Version11.1.1
Qualifiers
Subpath
Is_vulnerablefalse
Next_non_vulnerable_version11.2.3
Latest_non_vulnerable_version12.3.3
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-vqdy-2yzt-7qdf
vulnerability_id VCID-vqdy-2yzt-7qdf
summary 
Cross-Site Request Forgery (CSRF)
Pimcore is an Open Source Data & Experience Management Platform. In affected versions the `/admin/object/grid-proxy` endpoint calls `getFilterCondition()` on fields of classes to be filtered for, passing input from the request, and later executes the returned SQL. One implementation of `getFilterCondition()` is in `Multiselect`, which does not normalize/escape/validate the passed value. Any backend user with very basic permissions can execute arbitrary SQL statements and thus alter any data or escalate their privileges to at least admin level. This vulnerability has been addressed in version 11.1.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
references
0
reference_url https://github.com/pimcore/admin-ui-classic-bundle/blob/bba7c7419cb1f06d5fd98781eab4d6995e4e5dca/src/Helper/GridHelperService.php#L311
reference_id
reference_type
scores
url https://github.com/pimcore/admin-ui-classic-bundle/blob/bba7c7419cb1f06d5fd98781eab4d6995e4e5dca/src/Helper/GridHelperService.php#L311
1
reference_url https://github.com/pimcore/pimcore/blob/42b6cfa77c4540205bdd10689893ccb73e4bac8f/models/DataObject/ClassDefinition/Data/Multiselect.php#L285-L312
reference_id
reference_type
scores
url https://github.com/pimcore/pimcore/blob/42b6cfa77c4540205bdd10689893ccb73e4bac8f/models/DataObject/ClassDefinition/Data/Multiselect.php#L285-L312
2
reference_url https://github.com/pimcore/pimcore/commit/d164d99c90f098d0ccd6b72929c48b727e2953a0
reference_id
reference_type
scores
url https://github.com/pimcore/pimcore/commit/d164d99c90f098d0ccd6b72929c48b727e2953a0
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-47637
reference_id CVE-2023-47637
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-47637
4
reference_url https://github.com/advisories/GHSA-72hh-xf79-429p
reference_id GHSA-72hh-xf79-429p
reference_type
scores
url https://github.com/advisories/GHSA-72hh-xf79-429p
5
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-72hh-xf79-429p
reference_id GHSA-72hh-xf79-429p
reference_type
scores
url https://github.com/pimcore/pimcore/security/advisories/GHSA-72hh-xf79-429p
fixed_packages
0
url pkg:composer/pimcore/pimcore@11.1.1
purl pkg:composer/pimcore/pimcore@11.1.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@11.1.1
aliases CVE-2023-47637, GHSA-72hh-xf79-429p
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-vqdy-2yzt-7qdf
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@11.1.1