CVE-2023-5844 Unverified Password Change in pimcore/admin-ui-classic-bundle
Attackers can change user passwords without verification, leading to account takeover in Pimcore admin interfaces.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-5844?
CVE-2023-5844 is a medium-severity authentication bypass vulnerability in pimcore/admin-ui-classic-bundle, published on 30 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Unverified Password Change in GitHub repository pimcore/admin-ui-classic-bundle prior to 1.2.0.
Which versions are affected by CVE-2023-5844?
2 open source packages ship an affected version, including pimcore/admin-ui-classic-bundle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pimcore/admin-ui-classic-bundle Packagist | All versions | 1.2.0-RC1 |
pimcore/admin-ui-classic-bundle Packagist | All versions | 1.2.0-RC1 |
Products include Pimcore Admin Classic Bundle.
How do I fix CVE-2023-5844?
Upgrade pimcore/admin-ui-classic-bundle to 1.2.0-RC1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-5844 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-5844 exists.
Other vulnerabilities in pimcore/admin-ui-classic-bundle
- CVE-2024-23646 Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip
- CVE-2024-23648 Pimcore Admin Classic Bundle host header injection in the password reset
- CVE-2023-49075 Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
- CVE-2024-25625 Pimcore Host Header Injection in user invitation link
- CVE-2025-24980 Pimcore Admin Classic Bundle allows user enumeration
Sources
Also known as GHSA-6f58-j323-6472.