CVE-2024-49370 Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing
Attackers can read plaintext backend user passwords if portal users are linked to backend users with password sharing enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-49370?
CVE-2024-49370 is a high-severity vulnerability in Pimcore Pimcore, published on 23 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pimcore is an open source data and experience management platform. When a PortalUserObject is connected to a PimcoreUser and "Use Pimcore Backend Password" is set to true, the change password function in Portal Profile sets the new password. Prior to Pimcore portal engine versions 4.1.7 and 3.1.16, the password is then set without hashing so it can be read by everyone. Everyone who combines PortalUser to PimcoreUsers and change passwords via profile settings could be affected. Versions 4.1.7 and 3.1.16 of the Pimcore portal engine fix the issue.
Weakness: CWE-256
Which versions are affected by CVE-2024-49370?
It affects 1 product.
Products include Pimcore Pimcore.
How do I fix CVE-2024-49370?
No fix has been published for CVE-2024-49370 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-49370 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-49370 exists.
Other vulnerabilities in Pimcore Pimcore
- CVE-2022-39365 RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
- CVE-2019-18981 Pimcore Access Control Issues
- CVE-2019-18985 Pimcore 2FA Vulnerable to Brute Forcing
- CVE-2026-23492 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848
- CVE-2023-47637 SQL Injection in Admin Grid Filter API in Pimcore