CVE-2024-41109 Pimcore vulnerable to disclosure of system and database information behind /admin firewall

What is CVE-2024-41109?

CVE-2024-41109 is a medium-severity vulnerability in pimcore admin-ui-classic-bundle, published on 30 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.

Weakness: CWE-200

Which versions are affected by CVE-2024-41109?

2 open source packages ship an affected version, including pimcore/admin-ui-classic-bundle. It affects 1 product.

Products include Pimcore Admin Classic Bundle.

How do I fix CVE-2024-41109?

Upgrade pimcore/admin-ui-classic-bundle to 1.5.2 or later.

Is CVE-2024-41109 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-41109 exists.

Other vulnerabilities in pimcore admin-ui-classic-bundle

• CVE-2024-23646 Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip High 8.8
• CVE-2024-23648 Pimcore Admin Classic Bundle host header injection in the password reset High 8.8
• CVE-2023-49075 Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls High 8.5
• CVE-2024-25625 Pimcore Host Header Injection in user invitation link High 8.1
• CVE-2025-24980 Pimcore Admin Classic Bundle allows user enumeration Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fx6j-9pp6-ph36.