QwikSec

Security Database

CVE

CWE

Training

CVE-2019-10867

Published: Apr 4, 2019

Modified: Aug 4, 2024

PUBLISHED

Description

An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-173998

x_refsource_MISC

https://github.com/pimcore/pimcore/commit/38a29e2f4f5f060a73974626952501cee05fda73

x_refsource_MISC

http://packetstormsecurity.com/files/152667/Pimcore-Unserialize-Remote-Code-Execution.html

x_refsource_MISC

http://www.rapid7.com/db/modules/exploit/multi/http/pimcore_unserialize_rce

x_refsource_MISC

exploit

x_refsource_EXPLOIT-DB

https://blog.certimetergroup.com/it/articolo/security/polyglot_phar_deserialization_to_rce

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.