Medium severity · published Feb 7, 2025
CVE-2025-24980
Pimcore Admin Classic Bundle allows user enumeration
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore. In affected versions an error message discloses existing accounts and leads to user enumeration on the target via "Forgot password" function. No generic error message has been implemented. This issue has been addressed in version 1.7.4 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
admin-ui-classic-bundle · pimcore
< 1.7.4 · source: vendor
AC
Admin Classic Bundle · Pimcore
before 1.7.4.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-24980
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-24980
github.com
https://github.com/pimcore/admin-ui-classic-bundle/commit/96ae555578c3b4df368092d71e07a6c4ddf8fbe9
github.com
https://github.com/pimcore/admin-ui-classic-bundle/pull/808
Exploit
https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-vr5f-php7-rg24
More from admin-ui-classic-bundle
9.3
CVE-2024-25625
Pimcore Host Header Injection in user invitation link
9.1
CVE-2024-24822
Pimcore Admin Classic Bundle permissions are not getting checked when working with tags
8.8
CVE-2024-23646
Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip
8.8
CVE-2024-23648
Pimcore Admin Classic Bundle host header injection in the password reset
7.2
CVE-2023-49075
Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls