High severity · published Jun 4, 2024
CVE-2024-32871
Pimcore Vulnerable to Flooding Server with Thumbnail files
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
Pimcore is an Open Source Data & Experience Management Platform. The Pimcore thumbnail generation can be used to flood the server with large files. By changing the file extension or scaling factor of the requested thumbnail, attackers can create files that are much larger in file size than the original. This vulnerability is fixed in 11.2.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
pimcore · pimcore
>= 11.0.0, < 11.2.4 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-32871
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-32871
Patch
https://github.com/pimcore/pimcore/commit/38af70b3130f16fc27f2aea34e2943d7bdaaba06
Patch
https://github.com/pimcore/pimcore/commit/a6821a16ea38086bf6012e682e1743488244bd85
Exploit
https://github.com/pimcore/pimcore/security/advisories/GHSA-277c-5vvj-9pwx
More from pimcore
9.9
CVE-2026-55634
Pimcore: Remote Code Execution via DataObject Class-Definition Field Name
9.8
CVE-2022-39365
RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
9.8
CVE-2019-18985
Pimcore before 6.2.2 lacks brute force protection for the 2FA token
9.8
CVE-2019-18981
Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification
9.3
CVE-2026-55220
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column