SQL Injection in Pimcore · CVE-2022-1219 · GitHub Advisory Database · GitHub

SQL Injection in Pimcore

High severity GitHub Reviewed Published Apr 9, 2022 to the GitHub Advisory Database • Updated Jan 27, 2023

Package

pimcore/pimcore (Composer)

Affected versions

< 10.3.5

Patched versions

10.3.5

Description

Pimcore prior to version 10.3.5 is vulnerable SQL injection in RecyclebinController.php. This vulnerability affects data confidentiality.

References

Published by the National Vulnerability Database

Apr 8, 2022

Published to the GitHub Advisory Database Apr 9, 2022

Reviewed Apr 22, 2022

Last updated Jan 27, 2023

Severity

High

7.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N