CVE-2023-30852 Pimcore Arbitrary File Read in Admin JS CSS files
An authenticated administrator can read arbitrary JavaScript and CSS files from the server via path traversal in the script-proxy endpoint.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-30852?
CVE-2023-30852 is a medium-severity path traversal vulnerability in Pimcore Pimcore, published on 27 Apr 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the `/admin/misc/script-proxy` API endpoint that is accessible by an authenticated administrator user is vulnerable to arbitrary JavaScript and CSS file read via the `scriptPath` and `scripts` parameters. The `scriptPath` parameter is not sanitized properly and is vulnerable to path traversal attack. Any JavaScript/CSS file from the application server can be read by specifying sufficient number of `../` patterns to go out from the application webroot followed by path of the folder where the file is located in the "scriptPath" parameter and the file name in the "scripts" parameter. The JavaScript file is successfully read only if the web application has read access to it. Users should update to version 10.5.21 to receive a patch or, as a workaround, apply the patch manual.
Weakness: CWE-22
Which versions are affected by CVE-2023-30852?
2 open source packages ship an affected version, including pimcore/pimcore. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pimcore/pimcore Packagist | All versions | 10.5.21 |
pimcore/pimcore Packagist | All versions | 10.5.21 |
Products include Pimcore Pimcore.
How do I fix CVE-2023-30852?
Upgrade pimcore/pimcore to 10.5.21 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-30852 being exploited?
There is no known exploitation of CVE-2023-30852 in the wild and no public exploit code.
Other vulnerabilities in Pimcore Pimcore
- CVE-2022-39365 RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
- CVE-2019-18981 Pimcore Access Control Issues
- CVE-2019-18985 Pimcore 2FA Vulnerable to Brute Forcing
- CVE-2026-23492 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848
- CVE-2023-47637 SQL Injection in Admin Grid Filter API in Pimcore
Sources
Also known as GHSA-j5c3-r84f-9596.