CVE-2021-23405

EUVD-2021-1465
This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.3 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
snykCNA
8.3 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L/E:F/RL:O/RC:C
Base Score
CVSS 3.x
EPSS Score
Percentile: 7%
Affected Products (NVD)
VendorProductVersion
pimcorepimcore
𝑥
< 10.0.7
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/pimcore/pimcore/pull/9572
https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-1316297
https://github.com/pimcore/pimcore/pull/9572
https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-1316297