Medium severity · published Jan 11, 2024
CVE-2024-21665
Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list
4.3
CVSS
0.5%
EPSS
No
On KEV
Description
ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Access control and permissions are not being enforced. This vulnerability has been patched in version 1.0.10.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
ecommerce-framework-bundle · pimcore
< 1.0.10 · source: vendor
EF
E-commerce Framework · Pimcore
before 1.0.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-21665
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-21665
Issue Tracking
https://github.com/pimcore/ecommerce-framework-bundle/blob/ff6ff287b6eb468bb940909c56970363596e5c21/src/Controller/AdminOrderController.php#L98
Patch
https://github.com/pimcore/ecommerce-framework-bundle/commit/05dec000ed009828084d05cf686f468afd1f464e
Release Notes
https://github.com/pimcore/ecommerce-framework-bundle/releases/tag/v1.0.10
Exploit
https://github.com/pimcore/ecommerce-framework-bundle/security/advisories/GHSA-cx99-25hr-5jxf