CVE-2014-2922 Deserialization in n/a
Remote attackers can exploit PHP object injection in Pimcore to delete arbitrary files and potentially execute code via unsafe deserialization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-2922?
CVE-2014-2922 is a medium-severity unsafe deserialization vulnerability in Pimcore Pimcore, published on 21 Apr 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtained by unserializing a pathname, which allows remote attackers to conduct PHP object injection attacks and delete arbitrary files via vectors involving a Zend_Http_Response_Stream object.
Weakness: CWE-20
Which versions are affected by CVE-2014-2922?
It affects 1 product.
Products include Pimcore Pimcore.
How do I fix CVE-2014-2922?
No fix has been published for CVE-2014-2922 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2014-2922 being exploited?
There is no known exploitation of CVE-2014-2922 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Pimcore Pimcore
- CVE-2022-39365 RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
- CVE-2019-18981 Pimcore Access Control Issues
- CVE-2019-18985 Pimcore 2FA Vulnerable to Brute Forcing
- CVE-2026-23492 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848
- CVE-2023-47637 SQL Injection in Admin Grid Filter API in Pimcore
Sources
Also known as GHSA-63pp-7425-wfc8.