CVE-2023-38708
Description
Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. A path traversal vulnerability exists in the AssetController::importServerFilesAction, which allows an attacker to overwrite or modify sensitive files by manipulating the pimcore_log parameter.This can lead to potential denial of service---key file overwrite. The impact of this vulnerability allows attackers to: overwrite or modify sensitive files, potentially leading to unauthorized access, privilege escalation, or disclosure of confidential information. This could also cause a denial of service (DoS) if critical system files are overwritten or deleted.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
pimcore/pimcorePackagist | < 10.6.7 | 10.6.7 |
Affected products
3Patches
Vulnerability mechanics
References
4- github.com/pimcore/pimcore/commit/58012d0e3b8b926fb54eccbd64ec5c993b30c22cnvdPatchWEB
- github.com/pimcore/pimcore/security/advisories/GHSA-34hj-v8fm-x887nvdPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-34hj-v8fm-x887ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-38708ghsaADVISORY
News mentions
0No linked articles in our index yet.