CVE-2024-41109 json
Pimcore vulnerable to disclosure of system and database information behind /admin firewall
published 2024-07-30 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-2340 , GHSA-fx6j-9pp6-ph36
- cvss
- 6.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.
Patch / fix
- packagist pimcore/admin-ui-classic-bundle 1.5.2
- pimcore admin_classic_bundle 1.5.2
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| GitHub | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | pimcore/admin-ui-classic-bundle | <1.5.2 |
1.5.2 |
Affected products
- pimcore admin-ui-classic-bundle
- pimcore admin_classic_bundle
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0
web, patch
-
github.com
/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36
web, exploit, vendor-advisory
-
github.com
/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40
web, product
-
github.com
/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2024-41109
advisory
-
github.com
/pimcore/admin-ui-classic-bundle
package
Sources
- CVE List CVE-2024-41109
- GitHub Advisory GHSA-fx6j-9pp6-ph36
- NVD CVE-2024-41109
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.