CVE-2021-23405

This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.3 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
snykCNA
8.3 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L/E:F/RL:O/RC:C
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 4%
VendorProductVersion
pimcorepimcore
𝑥
< 10.0.7
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/pimcore/pimcore/pull/9572
https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-1316297
https://github.com/pimcore/pimcore/pull/9572
https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-1316297