Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-9njs-586x-j3dp
Vulnerability ID VCID-9njs-586x-j3dp
Aliases CVE-2024-24822
GHSA-3rfr-mpfj-2jwq
Summary Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. tags without having the permission to do so. A fix is available in version 1.3.3. As a workaround, one may apply the patch manually.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-862 Missing Authorization
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 3e-05 https://api.first.org/data/v1/epss?cve=CVE-2024-24822
epss 3e-05 https://api.first.org/data/v1/epss?cve=CVE-2024-24822
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-3rfr-mpfj-2jwq
cvssv3.1 6.5 https://github.com/pimcore/admin-ui-classic-bundle
generic_textual MODERATE https://github.com/pimcore/admin-ui-classic-bundle
cvssv3.1 6.5 https://github.com/pimcore/admin-ui-classic-bundle/commit/24660b6d5ad9cbcb037a48d4309a6024e9adf251
generic_textual MODERATE https://github.com/pimcore/admin-ui-classic-bundle/commit/24660b6d5ad9cbcb037a48d4309a6024e9adf251
ssvc Track https://github.com/pimcore/admin-ui-classic-bundle/commit/24660b6d5ad9cbcb037a48d4309a6024e9adf251
cvssv3.1 6.5 https://github.com/pimcore/admin-ui-classic-bundle/pull/412
generic_textual MODERATE https://github.com/pimcore/admin-ui-classic-bundle/pull/412
ssvc Track https://github.com/pimcore/admin-ui-classic-bundle/pull/412
cvssv3.1 6.5 https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-3rfr-mpfj-2jwq
cvssv3.1_qr MODERATE https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-3rfr-mpfj-2jwq
generic_textual MODERATE https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-3rfr-mpfj-2jwq
ssvc Track https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-3rfr-mpfj-2jwq
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2024-24822
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-24822
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-24822
https://github.com/pimcore/admin-ui-classic-bundle
24660b6d5ad9cbcb037a48d4309a6024e9adf251 https://github.com/pimcore/admin-ui-classic-bundle/commit/24660b6d5ad9cbcb037a48d4309a6024e9adf251
412 https://github.com/pimcore/admin-ui-classic-bundle/pull/412
CVE-2024-24822 https://nvd.nist.gov/vuln/detail/CVE-2024-24822
GHSA-3rfr-mpfj-2jwq https://github.com/advisories/GHSA-3rfr-mpfj-2jwq
GHSA-3rfr-mpfj-2jwq https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-3rfr-mpfj-2jwq
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/pimcore/admin-ui-classic-bundle
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/pimcore/admin-ui-classic-bundle/commit/24660b6d5ad9cbcb037a48d4309a6024e9adf251
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-07T20:21:11Z/ Found at https://github.com/pimcore/admin-ui-classic-bundle/commit/24660b6d5ad9cbcb037a48d4309a6024e9adf251
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/pimcore/admin-ui-classic-bundle/pull/412
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-07T20:21:11Z/ Found at https://github.com/pimcore/admin-ui-classic-bundle/pull/412
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-3rfr-mpfj-2jwq
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-07T20:21:11Z/ Found at https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-3rfr-mpfj-2jwq
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-24822
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.00072
EPSS Score 3e-05
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-10T18:47:22.692202+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2024/24xxx/CVE-2024-24822.json 38.6.0