GHSA-25fx-3c2q-cq46: pimcore/customer-management-framework-bundle has SQL Injection vulnerability in Segment Assignment query

Package

composer pimcore/customer-management-framework-bundle (Composer)

Affected versions

< 3.3.10

Patched versions

3.3.10

Description

Impact

An administrator user can use the inheritable segments feature to execute his own blind SQL queries.

A user with administrator privileges can run any SQL query on database. This can be used to retrieve sensitive data, change database information or any other malicious activity against the database.

Patches

Update to version 3.3.10 or apply this patch manually https://github.com/pimcore/customer-data-framework/commit/76df151737b7964ce5169fdf9e27a0ad801757fe.patch

Workarounds

Apply https://github.com/pimcore/customer-data-framework/commit/76df151737b7964ce5169fdf9e27a0ad801757fe.patch manually.

References

https://huntr.dev/bounties/cf398528-819f-456e-88e7-c06d268d3f44/

References

• GHSA-25fx-3c2q-cq46
• https://nvd.nist.gov/vuln/detail/CVE-2023-2756
• pimcore/customer-data-framework@76df151
• https://huntr.dev/bounties/cf398528-819f-456e-88e7-c06d268d3f44

dvesh3 published to pimcore/customer-data-framework

May 17, 2023

Published to the GitHub Advisory Database

May 17, 2023

Reviewed

May 17, 2023

Last updated

May 17, 2023