Unscored severity · published Apr 21, 2014
CVE-2014-2921
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing…
–
CVSS
6.4%
EPSS
No
On KEV
Description
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a Zend_Pdf_ElementFactory_Proxy object and a pathname with a trailing \0 character.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.4% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
Pimcore · Pimcore
1.4.9; 1.5.0; 2.1.0; 2.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-2921
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-2921
openwall.com
http://openwall.com/lists/oss-security/2014/04/21/1
Patch
http://www.pimcore.org/en/resources/blog/pimcore+2.2+released_b442
Exploit
https://github.com/pedrib/PoC/blob/master/pimcore-2.1.0.txt
More from Pimcore
9.9
CVE-2026-55634
Pimcore: Remote Code Execution via DataObject Class-Definition Field Name
9.8
CVE-2022-39365
RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
9.8
CVE-2019-18985
Pimcore before 6.2.2 lacks brute force protection for the 2FA token
9.8
CVE-2019-18981
Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification
9.3
CVE-2026-55220
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column