{"id":"CVE-2019-10867","published":"2019-04-04T17:51:16Z","modified":"2024-08-04T22:32:02Z","title":"An issue was discovered in Pimcore before 5.7.1","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.","provenance":"source","from":"CVE.org"},"summary":{"text":"Pimcore versions before 5.7.1 contain a flaw in the ClassController component (bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php), where untrusted values passed in the data parameter of the /admin/class/bulk-commit endpoint are processed by the unserialize function. An attacker who holds the classes permission can send a POST request to that endpoint carrying a crafted data value to exploit the unsafe deserialization.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:18:50Z"},"cvss":null,"epss":{"score":0.68874,"percentile":0.99348,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[],"references":[{"url":"https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-173998","tags":["x_refsource_MISC"]},{"url":"https://github.com/pimcore/pimcore/commit/38a29e2f4f5f060a73974626952501cee05fda73","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/152667/Pimcore-Unserialize-Remote-Code-Execution.html","tags":["x_refsource_MISC"]},{"url":"http://www.rapid7.com/db/modules/exploit/multi/http/pimcore_unserialize_rce","tags":["x_refsource_MISC"]},{"url":"https://www.exploit-db.com/exploits/46783/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://blog.certimetergroup.com/it/articolo/security/polyglot_phar_deserialization_to_rce","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Packagist","package":"pimcore/pimcore","vulnerableRanges":["<5.7.1"],"patched":["5.7.1"],"from":["GHSA-7hqr-j26m-gmwp"],"provenance":"source"}],"advisories":[{"id":"GHSA-7hqr-j26m-gmwp","url":"https://github.com/advisories/GHSA-7hqr-j26m-gmwp","severity":"HIGH","ecosystem":"Packagist","package":"pimcore/pimcore","vulnerableRanges":["<5.7.1"],"patched":["5.7.1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-3014","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3014","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":46783,"url":"https://www.exploit-db.com/exploits/46783","title":"Pimcore < 5.71 - Unserialize Remote Code Execution (Metasploit)","type":"remote","platform":"php","date":"2019-04-30","verified":true,"provenance":"source"},{"id":46783,"url":"https://www.exploit-db.com/exploits/46783","title":"Pimcore < 5.71 - Unserialize Remote Code Execution (Metasploit)","type":"remote","platform":"php","date":"2019-04-30","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2019-04-30"},"metasploit":[{"name":"Pimcore Unserialize RCE","module":"exploit/multi/http/pimcore_unserialize_rce","type":"exploit","disclosureDate":"2019-03-11","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/pimcore_unserialize_rce.rb"}],"first":{"date":"2019-03-11","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/pimcore_unserialize_rce.rb"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/46783/","http://packetstormsecurity.com/files/152667/Pimcore-Unserialize-Remote-Code-Execution.html","https://www.exploit-db.com/exploits/46783"],"flow":[],"timeline":[{"date":"2019-03-11","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2019-04-30","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/pimcore_unserialize_rce.rb","provenance":"source"},{"date":"2019-04-04","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-10867","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":24.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.87,"detail":"percentile 0.9935"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 2 Exploit-DB entries; 1 NVD exploit link; 1 advisory exploit reference; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2018-14057","published":"2018-08-17","fixed":"5.3.0","kev":false},{"cve":"CVE-2018-14058","published":"2018-08-17","fixed":"5.3.0","kev":false},{"cve":"CVE-2018-14059","published":"2018-08-24","fixed":"5.3.0","kev":false,"link":{"from":"CVE-2018-14059","to":"CVE-2019-10867","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:pimcore/pimcore","fromFixed":"5.3.0","toFixed":"5.7.1","daysApart":223}]}},{"cve":"CVE-2019-10867","published":"2019-04-04","fixed":"5.7.1","kev":false},{"cve":"CVE-2019-16317","published":"2019-09-14","fixed":"5.7.1","kev":false},{"cve":"CVE-2019-16318","published":"2019-09-14","fixed":"5.7.1","kev":false},{"cve":"CVE-2019-18981","published":"2019-11-15","fixed":"6.2.2","kev":false}],"package":"Packagist:pimcore/pimcore"}}