CVE-2024-41109

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-41109
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40 Product
https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0 Patch
https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2 Release Notes
https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36 Exploit Vendor Advisory
https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40 Product
https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0 Patch
https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2 Release Notes
https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:pimcore:admin_classic_bundle:*:*:*:*:*:pimcore:*:*
cpe:2.3:a:pimcore:admin_classic_bundle:*:*:*:*:*:pimcore:*:*
cpe:2.3:a:pimcore:admin_classic_bundle:*:*:*:*:*:pimcore:*:*
History

04 Nov 2025, 18:01

Type Values Removed Values Added
CPE cpe:2.3:a:pimcore:admin_classic_bundle:*:*:*:*:*:pimcore:*:*
First Time Pimcore admin Classic Bundle
Pimcore
CWE NVD-CWE-noinfo
References () https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40 - () https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40 - Product
References () https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0 - () https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0 - Patch
References () https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2 - () https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2 - Release Notes
References () https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36 - () https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36 - Exploit, Vendor Advisory

21 Nov 2024, 09:32

Type Values Removed Values Added
References () https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40 - () https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40 -
References () https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0 - () https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0 -
References () https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2 - () https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2 -
References () https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36 - () https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36 -

31 Jul 2024, 12:57

Type Values Removed Values Added
Summary
  • (es) El paquete Admin Classic de Pimcore proporciona una interfaz de usuario backend para Pimcore. Navegar a `/admin/index/statistics` con un usuario de Pimcore conectado expone información sobre la instalación de Pimcore, la versión de PHP, la versión de MYSQL, los paquetes instalados y todas las tablas de la base de datos y su recuento de filas en el sistema. Esta vulnerabilidad se solucionó en 1.5.2, 1.4.6 y 1.3.10.

30 Jul 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-30 15:15

Updated : 2025-11-04 18:01

NVD link : CVE-2024-41109

Mitre link : CVE-2024-41109

CVE.ORG link : CVE-2024-41109

JSON object : View

Products Affected

pimcore

  • admin_classic_bundle
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo