Pimcore CVE-2023-3574

MEDIUM

Improper Authorization (CWE-285)

2023-07-10 security@huntr.dev

Authentication Bypass Pimcore Customer Management Framework

6.5

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

1

CVE Published

Jul 10, 2023 - 16:15 nvd

MEDIUM 6.5

DescriptionNVD

Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1.

AnalysisAI

Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-285. Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1. Affected products include: Pimcore Customer Management Framework. Version information: prior to 3.4.1..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Pimcore

View all

CVE-2019-10867 HIGH Act Now POC

An issue was discovered in Pimcore before 5.7.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploita

CVE-2024-25625 CRITICAL Act Now POC

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Rated critical severity (CVSS 9.3), this vulnerability

CVE-2021-4139 CRITICAL Act Now POC

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated cri

CVE-2026-23492 HIGH This Week POC

Blind SQL injection in Pimcore's Admin Search Find API allows authenticated attackers to extract database information th

CVE-2024-23646 HIGH This Week POC

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Rated high severity (CVSS 8.8), this vulne

CVE-2024-23648 HIGH This Week POC

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Rated high severity (CVSS 8.8), this vulne

CVE-2023-47637 HIGH This Week POC

Pimcore is an Open Source Data & Experience Management Platform. Rated high severity (CVSS 8.8), this vulnerability is r

CVE-2023-2984 HIGH This Week POC

Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22. Rated high severity (CVSS 8.8), th

CVE-2023-2983 HIGH This Week POC

Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23. Rated high severity (CVSS 8

CVE-2023-2338 HIGH This Week POC

SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21. Rated high severity (CVSS 8.8), this vulnerability

CVE-2023-1578 HIGH This Week POC

SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19. Rated high severity (CVSS 8.8), this vulnerability

CVE-2023-25240 HIGH This Week POC

An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code. Rated high

Same weakness CWE-285 – Improper Authorization

View all

CVE-2025-29927 CRITICAL POC

CVE-2016-5676 HIGH POC

CVE-2025-66301 CRITICAL POC

CVE-2023-32707 HIGH POC

CVE-2016-3352 HIGH

CVE-2025-29659 CRITICAL POC

CVE-2022-2595 CRITICAL POC

CVE-2026-55166 CRITICAL POC

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2013-2465 CRITICAL POC

CVE-2011-3544 CRITICAL POC

CVE-2022-40684 CRITICAL POC

CVE-2025-61882 CRITICAL POC

CVE-2024-0012 CRITICAL POC

CVE-2023-46805 HIGH POC

Share

CVE-2023-3574 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy