CVE-2024-41109

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-41109
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-41109.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-41109
Aliases
Published
2024-07-30T14:43:14Z
Modified
2025-11-06T01:19:31.974353Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Pimcore vulnerable to disclosure of system and database information behind /admin firewall
Details

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to /admin/index/statistics with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.

Database specific 
{
    "cwe_ids": [
        "CWE-200"
    ]
}
References

Affected packages

Git / github.com/pimcore/admin-ui-classic-bundle

Affected ranges

Type
GIT
Repo
https://github.com/pimcore/admin-ui-classic-bundle
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
022e87f147eaa7a39debb69b1cd9662ede49a535

Affected versions

1.*

1.4.0

v1.*

v1.0.0
v1.0.0-BETA1
v1.0.0-RC1
v1.0.0-RC2
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.1.0
v1.1.0-RC1
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.2.0
v1.2.0-RC1
v1.2.1
v1.2.2
v1.2.3
v1.3.0
v1.3.0-RC1
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.5.0
v1.5.0-RC1
v1.5.0-RC2
v1.5.1