Pimcore vulnerable to Business Logic Errors in Customer automation rules

Vulnerability

The Pimcore Customer Management Framework (CMF) bundle prior to version 3.3.9 contained a business logic flaw in the Conditions tab of its administrative interface [1]. The counter fields used in condition definitions (e.g., "Count Activities", "Count Tracked Segment") lacked proper input validation, allowing negative integer values to be submitted [4].

Exploitation

An attacker with access to the Pimcore backend—specifically the rule configuration interface—could manually enter a negative number in the count field of any of the affected condition types. The patch diff shows that the minValue: 0 constraint was missing from the three numberfield components for CountActivities, CountTrackedSegment, and CountTargetGroupWeight [4]. No authentication bypass or network‑level vector is described; the flaw is a client‑side (UI) validation gap that an authenticated administrator could exploit.

Impact

Accepting a negative counter value corrupts the business logic of the condition, potentially leading to incorrect evaluation of customer segments, personalization rules, or marketing automation triggers [1]. This could allow an attacker to disrupt expected behavior of the CMF, for example by creating conditions that always fail or always succeed due to an invalid count parameter.

Mitigation

The issue has been fixed in version 3.3.9 of the pimcore/customer-management-framework-bundle [3]. Users should update to that release or apply the provided patch manually [4]. Note that the open‑source repository is now archived and the bundle has moved to the Pimcore Enterprise Edition; however, the patch remains available for all versions prior to 3.3.9 [2].