Vulnerability Details : CVE-2019-10867
Public exploit exists!
An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.
Products affected by CVE-2019-10867
- cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-10867
54.62%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 98 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2019-10867
-
Pimcore Unserialize RCE
Disclosure Date: 2019-03-11First seen: 2020-04-26exploit/multi/http/pimcore_unserialize_rceThis module exploits a PHP unserialize() in Pimcore before 5.7.1 to execute arbitrary code. An authenticated user with "classes" permission could exploit the vulnerability. The vulnerability exists in the "ClassController.php" class, where the "bulk-commit"
CVSS scores for CVE-2019-10867
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
NIST | |
8.8
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2019-10867
-
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-10867
-
https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-173998
Deserialization of Untrusted Data in pimcore/pimcore | SnykExploit;Third Party Advisory
-
https://blog.certimetergroup.com/it/articolo/security/polyglot_phar_deserialization_to_rce
Polyglot PHAR's deserialization for backdoored RCE (CVE-2019-10867) | Blog Certimeter Group
-
https://github.com/pimcore/pimcore/commit/38a29e2f4f5f060a73974626952501cee05fda73
[Object] optimized bulk import · pimcore/pimcore@38a29e2 · GitHubPatch;Third Party Advisory
-
https://www.exploit-db.com/exploits/46783/
Pimcore < 5.71 - Unserialize Remote Code Execution (Metasploit)Exploit;Third Party Advisory;VDB Entry
-
http://packetstormsecurity.com/files/152667/Pimcore-Unserialize-Remote-Code-Execution.html
Pimcore Unserialize Remote Code Execution ≈ Packet StormExploit;Third Party Advisory;VDB Entry
-
http://www.rapid7.com/db/modules/exploit/multi/http/pimcore_unserialize_rce
Pimcore Unserialize RCE | Rapid7Third Party Advisory
Jump to