ChainpimcorePackagist:pimcore/pimcore
pimcore: successive fixes (2019–2023)
5 CVEs over 3 generations, 15 Nov 2019 to 30 May 2023.
Family tree
Left to right by publication date.Oldest first. Select a CVE to open it.- CVE-2019-1898515 Nov 2019 First in the chain
- CVE-2021-3918915 Sep 2021 related to CVE-2019-18985
- CVE-2021-408210 Dec 2021 related to CVE-2021-39189related to CVE-2019-18985
- CVE-2023-239373 Feb 2023 related to CVE-2019-18985
- CVE-2023-298330 May 2023 related to CVE-2019-18985related to CVE-2023-23937
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
CVEs in this family
Table view of the tree| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2019-18985 | 15 Nov 2019 | Pimcore before 6.2.2 lacks brute force protection for the 2FA token · fixed in 6.2.2 | First in chain | 14.6 |
| CVE-2021-39189 | 15 Sep 2021 | Observable Response Discrepancy in Lost Password Service · fixed in 10.1.3 | CVE-2019-18985 · related · Medium | 18.1 |
| CVE-2021-4082 | 10 Dec 2021 | Cross-Site Request Forgery (CSRF) in pimcore/pimcore · fixed in 10.2.6 | CVE-2021-39189 · related · High | 10.7 |
| CVE-2023-23937 | 3 Feb 2023 | Missing file upload type validation in pimcore/pimcore · fixed in 10.5.16 | CVE-2019-18985 · related · Medium | 14.0 |
| CVE-2023-2983 | 30 May 2023 | Privilege Defined With Unsafe Actions in pimcore/pimcore · fixed in 10.5.23 | CVE-2019-18985 · related · Medium | 16.6 |