Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS05d3dnLXIzYzctNHZmZ84AA3Ye

Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls

Impact

AdminBundle\Security\PimcoreUserTwoFactorCondition introduced in v11 disable the two factor authentication for all non-admin security firewalls.

An authenticated user can access the system without having to provide the 2 factor credentials.

Patches

Apply patch https://patch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch

Workarounds

Upgrade to version 1.2.2 or apply the patch manually.

Permalink: https://github.com/advisories/GHSA-9wwg-r3c7-4vfg
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05d3dnLXIzYzctNHZmZ84AA3Ye
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 12 months ago
Updated: 12 months ago

CVSS Score: 8.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Identifiers: GHSA-9wwg-r3c7-4vfg, CVE-2023-49075
References:

• https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-9wwg-r3c7-4vfg
• https://github.com/pimcore/admin-ui-classic-bundle/pull/345
• https://github.com/pimcore/admin-ui-classic-bundle/commit/e412b0597830ae564a604e2579eb40e76f7f0628
• https://patch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-49075
• https://github.com/advisories/GHSA-9wwg-r3c7-4vfg

Repository: https://github.com/pimcore/admin-ui-classic-bundle
Blast Radius: 7.2

Affected Packages