CVE-2023-23937 Missing file upload type validation in pimcore/pimcore
Authenticated attackers can upload malicious HTML files with JavaScript by bypassing content-type validation, leading to code execution in the victim's browser context.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-23937?
CVE-2023-23937 is a high-severity vulnerability in Pimcore Pimcore, published on 3 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. The upload functionality for updating user profile does not properly validate the file content-type, allowing any authenticated user to bypass this security check by adding a valid signature (p.e. GIF89) and sending any invalid content-type. This could allow an authenticated attacker to upload HTML files with JS content that will be executed in the context of the domain. This issue has been patched in version 10.5.16.
Weakness: CWE-434
Which versions are affected by CVE-2023-23937?
2 open source packages ship an affected version, including pimcore/pimcore. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pimcore/pimcore Packagist | All versions | 10.5.16 |
pimcore/pimcore Packagist | All versions | 10.5.16 |
Products include Pimcore Pimcore.
How do I fix CVE-2023-23937?
Upgrade pimcore/pimcore to 10.5.16 or later.
Is CVE-2023-23937 being exploited?
There is no known exploitation of CVE-2023-23937 in the wild and no public exploit code.
Other vulnerabilities in Pimcore Pimcore
- CVE-2022-39365 RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
- CVE-2019-18981 Pimcore Access Control Issues
- CVE-2019-18985 Pimcore 2FA Vulnerable to Brute Forcing
- CVE-2026-23492 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848
- CVE-2023-47637 SQL Injection in Admin Grid Filter API in Pimcore
Sources
Also known as GHSA-8xv4-jj4h-qww6.