Admin Classic Bundle vulnerabilities
5 known vulnerabilities in Admin Classic Bundle from Pimcore. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.3 Critical severity
admin-ui-classic-bundle: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential security vulnerability has been discovered in `pimcore/admin-ui-classic-bundle` prior to version 1.3.4. The vulnerability involves a Host Header Injection in the `invitationLinkActio
- 9.1 Critical severity
admin-ui-classic-bundle: Missing Authorization
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. tags without having the permission to do so. A fix is available in version 1.3.3. As a workaround, one may apply the patch
- 8.8 High severity
admin-ui-classic-bundle: Improper Neutralization of Special Elements used in an SQL Command
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The application allows users to create zip files from available files on the site. In the 1.x branch prior to version 1.3.2, parameter `selectedIds` is susceptible to SQL Injection.
- 8.8 High severity
admin-ui-classic-bundle: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The password reset functionality sends to the the user requesting a password change an email containing an URL to reset its password. The URL sent contains a unique token, valid duri
- 7.2 High severity
admin-ui-classic-bundle: Use of Single-factor Authentication
The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without h