Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-bexg-r2xt-6ycy
Vulnerability ID VCID-bexg-r2xt-6ycy
Aliases CVE-2021-39189
GHSA-579x-cjvr-cqj9
Summary Information Exposure Through Discrepancy Pimcore is an open source data & experience management platform. A flaw was found identifying it is possible to enumerate usernames via the forgot password functionality.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-203 Observable Discrepancy
CWE-204 Observable Response Discrepancy
System Score Found at
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2021-39189
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-579x-cjvr-cqj9
cvssv3.1 5.3 https://github.com/pimcore/pimcore
generic_textual MODERATE https://github.com/pimcore/pimcore
cvssv3.1 5.3 https://github.com/pimcore/pimcore/pull/10223/commits/d0a4de39cf05dce6af71f8ca039132bdfcbb0dce
generic_textual MODERATE https://github.com/pimcore/pimcore/pull/10223/commits/d0a4de39cf05dce6af71f8ca039132bdfcbb0dce
cvssv3.1 5.3 https://github.com/pimcore/pimcore/pull/10223.patch
generic_textual MODERATE https://github.com/pimcore/pimcore/pull/10223.patch
cvssv3.1 5.3 https://github.com/pimcore/pimcore/security/advisories/GHSA-579x-cjvr-cqj9
cvssv3.1_qr MODERATE https://github.com/pimcore/pimcore/security/advisories/GHSA-579x-cjvr-cqj9
generic_textual MODERATE https://github.com/pimcore/pimcore/security/advisories/GHSA-579x-cjvr-cqj9
cvssv3.1 5.3 https://huntr.dev/bounties/12462a99-ebf8-4e39-80b3-54a16caa3f4c
generic_textual MODERATE https://huntr.dev/bounties/12462a99-ebf8-4e39-80b3-54a16caa3f4c
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2021-39189
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2021-39189
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2021-39189
https://github.com/pimcore/pimcore
https://github.com/pimcore/pimcore/pull/10223/commits/d0a4de39cf05dce6af71f8ca039132bdfcbb0dce
https://github.com/pimcore/pimcore/pull/10223.patch
https://github.com/pimcore/pimcore/security/advisories/GHSA-579x-cjvr-cqj9
https://huntr.dev/bounties/12462a99-ebf8-4e39-80b3-54a16caa3f4c
https://huntr.dev/bounties/12462a99-ebf8-4e39-80b3-54a16caa3f4c/
CVE-2021-39189 https://nvd.nist.gov/vuln/detail/CVE-2021-39189
GHSA-579x-cjvr-cqj9 https://github.com/advisories/GHSA-579x-cjvr-cqj9
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/pimcore/pimcore
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/pimcore/pimcore/pull/10223/commits/d0a4de39cf05dce6af71f8ca039132bdfcbb0dce
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/pimcore/pimcore/pull/10223.patch
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/pimcore/pimcore/security/advisories/GHSA-579x-cjvr-cqj9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://huntr.dev/bounties/12462a99-ebf8-4e39-80b3-54a16caa3f4c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-39189
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.05926
EPSS Score 0.0002
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T20:55:50.973572+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/pimcore/pimcore/CVE-2021-39189.yml 38.6.0