CVE-2023-5192 Excessive Data Query Operations in a Large Data Table in pimcore/demo
Attackers can cause denial of service by triggering excessive data query operations in large data tables within the Pimcore demo application.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-5192?
CVE-2023-5192 is a medium-severity denial of service vulnerability in pimcore/demo, published on 26 Sep 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Excessive Data Query Operations in a Large Data Table in GitHub repository pimcore/demo prior to 10.3.0.
Weakness: CWE-1049
Which versions are affected by CVE-2023-5192?
2 open source packages ship an affected version, including pimcore/demo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pimcore/demo Packagist | All versions | 10.3.0 |
pimcore/demo Packagist | All versions | 10.3.0 |
Products include Pimcore Core.
How do I fix CVE-2023-5192?
Upgrade pimcore/demo to 10.3.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-5192 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-5192 exists.
Sources
Also known as GHSA-p76j-h4m8-hx5c.