VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Feb 7, 2024· Updated Nov 7, 2024

Pimcore Admin Classic Bundle permissions are not getting checked when working with tags

CVE-2024-24822

Description

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. tags without having the permission to do so. A fix is available in version 1.3.3. As a workaround, one may apply the patch manually.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pimcore/admin-ui-classic-bundlePackagist
< 1.3.31.3.3

Affected products

1

Patches

1
24660b6d5ad9

Fix: Tag access rights (#412)

https://github.com/pimcore/admin-ui-classic-bundlerobertSt7Feb 7, 2024via ghsa
commit
1 file changed · +6 −0
  • src/Controller/Admin/TagsController.php+6 −0 modified
    @@ -41,6 +41,8 @@ class TagsController extends AdminAbstractController
      */
     public function addAction(Request $request): JsonResponse
     {
+        $this->checkPermission('tags_configuration');
+
         try {
             $tag = new Tag();
             $tag->setName(strip_tags($request->get('text', '')));
@@ -64,6 +66,8 @@ public function addAction(Request $request): JsonResponse
      */
     public function deleteAction(Request $request): JsonResponse
     {
+        $this->checkPermission('tags_configuration');
+
         $tag = Tag::getById((int) $request->get('id'));
         if ($tag) {
             $tag->delete();
@@ -85,6 +89,8 @@ public function deleteAction(Request $request): JsonResponse
      */
     public function updateAction(Request $request): JsonResponse
     {
+        $this->checkPermission('tags_configuration');
+
         $tag = Tag::getById((int) $request->get('id'));
         if ($tag) {
             $parentId = $request->get('parentId');

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.