Medium severity · published May 11, 2023
CVE-2023-32075
Pimcore vulnerable to Business Logic Errors in Customer automation rules
4.3
CVSS
0.8%
EPSS
No
On KEV
Description
The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management. In `pimcore/customer-management-framework-bundle` prior to version 3.3.9, business logic errors are possible in the `Conditions` tab since the counter can be a negative number. This vulnerability is capable of the unlogic in the counter value in the Conditions tab. Users should update to version 3.3.9 to receive a patch or, as a workaround, or apply the patch manually.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
customer-data-framework · pimcore
< 3.3.9 · source: vendor
CM
Customer Management Framework · Pimcore
before 3.3.9 · source: NVD
Affected product
CU
customer-data-framework
pimcore
More from customer-data-framework
7.2
CVE-2024-11956
Pimcore customer-data-framework list sql injection
6.5
CVE-2024-21667
Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts
6.5
CVE-2024-21666
Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list
6.5
CVE-2023-49076
Pimcore missing token/header to prevent CSRF
6.5
CVE-2023-3574
Improper Authorization in pimcore/customer-data-framework