CVE-2024-29197 Pimcore Preview Documents are not restricted to logged in users anymore
Unauthenticated attackers can view unpublished Pimcore content by appending a specific query parameter, exposing confidential information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-29197?
CVE-2024-29197 is a medium-severity missing authorization vulnerability in Pimcore Pimcore, published on 26 Mar 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Pimcore is an Open Source Data & Experience Management Platform. Any call with the query argument `?pimcore_preview=true` allows to view unpublished sites. In previous versions of Pimcore, session information would propagate to previews, so only a logged in user could open a preview. This no longer applies. Previews are broad open to any user and with just the hint of a restricted link one could gain access to possible confident / unreleased information. This vulnerability is fixed in 11.2.2 and 11.1.6.1.
Weakness: CWE-200
Which versions are affected by CVE-2024-29197?
It affects 1 product.
Products include Pimcore Pimcore.
How do I fix CVE-2024-29197?
No fix has been published for CVE-2024-29197 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-29197 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-29197 exists.
Other vulnerabilities in Pimcore Pimcore
- CVE-2022-39365 RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
- CVE-2019-18981 Pimcore Access Control Issues
- CVE-2019-18985 Pimcore 2FA Vulnerable to Brute Forcing
- CVE-2026-23492 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848
- CVE-2023-47637 SQL Injection in Admin Grid Filter API in Pimcore
Sources
Also known as GHSA-5737-rqv4-v445.