CVE-2023-49075 Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
Authenticated users can bypass two-factor authentication in non-admin security firewalls, allowing unauthorized access without second-factor verification.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-49075?
CVE-2023-49075 is a high-severity vulnerability in pimcore admin-ui-classic-bundle, published on 28 Nov 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without having to provide the two factor credentials. This issue has been patched in version 1.2.2.
Weakness: CWE-308
Which versions are affected by CVE-2023-49075?
2 open source packages ship an affected version, including pimcore/admin-ui-classic-bundle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pimcore/admin-ui-classic-bundle Packagist | All versions | 1.2.2 |
pimcore/admin-ui-classic-bundle Packagist | All versions | 1.2.2 |
Products include Pimcore Admin Classic Bundle.
How do I fix CVE-2023-49075?
Upgrade pimcore/admin-ui-classic-bundle to 1.2.2 or later.
Is CVE-2023-49075 being exploited?
There is no known exploitation of CVE-2023-49075 in the wild and no public exploit code.
Other vulnerabilities in pimcore admin-ui-classic-bundle
- CVE-2024-23646 Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip
- CVE-2024-23648 Pimcore Admin Classic Bundle host header injection in the password reset
- CVE-2024-25625 Pimcore Host Header Injection in user invitation link
- CVE-2025-24980 Pimcore Admin Classic Bundle allows user enumeration
- CVE-2024-24822 Pimcore Admin Classic Bundle permissions are not getting checked when working with tags
Sources
Also known as GHSA-9wwg-r3c7-4vfg.