CVE-2023-37280
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Pimcore Admin Classic Bundle, based on the ExtJS framework, has a vulnerability that allows an administrator who has not set up two-factor authentication to execute arbitrary scripts/HTML content. The attack does not require any privileges.
Risk Assessment
The lack of two-factor authentication exposes the application to the execution of malicious code, which can lead to serious data security breaches.
Recommendation
It is recommended to configure two-factor authentication for all administrators and to update to version 1.0.3, where this vulnerability has been patched.
Original NVD description (English source)
Pimcore Admin Classic Bundle provides a Backend UI for Pimcore based on the ExtJS framework. An admin who has not setup two factor authentication before is vulnerable for this attack, without need for any form of privilege, causing the application to execute arbitrary scripts/HTML content. This vulnerability has been patched in version 1.0.3.