CVE-2023-49076 Pimcore missing token/header to prevent CSRF
Attackers can perform CSRF attacks to create new customers due to missing tokens in the Pimcore customer data framework.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-49076?
CVE-2023-49076 is a medium-severity vulnerability in Pimcore Pimcore, published on 30 Nov 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an attacker could abuse this vulnerability to create new customers. This issue has been patched in version 4.0.5.
Weakness: CWE-352
Which versions are affected by CVE-2023-49076?
It affects 1 product.
Products include Pimcore Pimcore.
How do I fix CVE-2023-49076?
No fix has been published for CVE-2023-49076 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-49076 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-49076 exists.
Other vulnerabilities in Pimcore Pimcore
- CVE-2022-39365 RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
- CVE-2019-18981 Pimcore Access Control Issues
- CVE-2019-18985 Pimcore 2FA Vulnerable to Brute Forcing
- CVE-2026-23492 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848
- CVE-2023-47637 SQL Injection in Admin Grid Filter API in Pimcore
Sources
Also known as GHSA-xx63-4jr8-9ghc.