CVE-2023-38708
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Pimcore has a path traversal vulnerability in the `AssetController::importServerFilesAction`, allowing an attacker to overwrite or modify sensitive files by manipulating the pimcore_log parameter.
Risk Assessment
This vulnerability can lead to unauthorized access, privilege escalation, or disclosure of confidential information. There is also a risk of denial of service (DoS) if critical system files are overwritten or deleted.
Recommendation
It is recommended to update Pimcore to the latest version and implement appropriate security measures to restrict manipulation of the pimcore_log parameter.
Original NVD description (English source)
Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. A path traversal vulnerability exists in the `AssetController::importServerFilesAction`, which allows an attacker to overwrite or modify sensitive files by manipulating the pimcore_log parameter.This can lead to potential denial of service---key file overwrite. The impact of this vulnerability allows attackers to: overwrite or modify sensitive files, potentially leading to unauthorized access, privilege escalation, or disclosure of confidential information. This could also cause a denial of service (DoS) if critical system files are overwritten or deleted.