Medium severity · published Nov 30, 2023
CVE-2023-49076
Pimcore missing token/header to prevent CSRF
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an attacker could abuse this vulnerability to create new customers. This issue has been patched in version 4.0.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
customer-data-framework · pimcore
< 4.0.5 · source: vendor
PI
Pimcore · Pimcore
before 4.0.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-49076
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-49076
Patch
https://github.com/pimcore/customer-data-framework/commit/ef7414415cfa64189b8433eff0aa2a9b537a89f7.patch
Exploit
https://github.com/pimcore/customer-data-framework/security/advisories/GHSA-xx63-4jr8-9ghc
More from customer-data-framework
7.2
CVE-2024-11956
Pimcore customer-data-framework list sql injection
6.5
CVE-2024-21667
Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts
6.5
CVE-2024-21666
Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list
6.5
CVE-2023-3574
Improper Authorization in pimcore/customer-data-framework
5.4
CVE-2023-4145
Cross-site Scripting (XSS) - Stored in pimcore/customer-data-framework