Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS05d3dnLXIzYzctNHZmZ84AA3Ye

Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls

Impact

AdminBundle\Security\PimcoreUserTwoFactorCondition introduced in v11 disable the two factor authentication for all non-admin security firewalls.

An authenticated user can access the system without having to provide the 2 factor credentials.

Patches

Apply patch https://patch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch

Workarounds

Upgrade to version 1.2.2 or apply the patch manually.

Permalink: https://github.com/advisories/GHSA-9wwg-r3c7-4vfg
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05d3dnLXIzYzctNHZmZ84AA3Ye
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 5 months ago
Updated: 5 months ago


CVSS Score: 8.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Identifiers: GHSA-9wwg-r3c7-4vfg, CVE-2023-49075
References: Repository: https://github.com/pimcore/admin-ui-classic-bundle
Blast Radius: 7.2

Affected Packages

packagist:pimcore/admin-ui-classic-bundle
Dependent packages: 21
Dependent repositories: 7
Downloads: 262,242 total
Affected Version Ranges: < 1.2.2
Fixed in: 1.2.2
All affected versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.2.1
All unaffected versions: 1.2.2, 1.2.3, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.4.0