CVE-2023-32075 : The Customer Management Framework (CMF) for Pimcore adds functionality for custo

The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management. In `pimcore/customer-management-framework-bundle` prior to version 3.3.9, business logic errors are possible in the `Conditions` tab since the counter can be a negative number. This vulnerability is capable of the unlogic in the counter value in the Conditions tab. Users should update to version 3.3.9 to receive a patch or, as a workaround, or apply the patch manually.

Published 2023-05-11 17:15:09

Updated 2023-05-22 18:19:19

Source GitHub, Inc.

View at NVD, CVE.org

Vulnerability category: Input validation

Products affected by CVE-2023-32075

Pimcore » Customer Management Framework » For Pimcore
Versions before (<) 3.3.9
cpe:2.3:a:pimcore:customer_management_framework:*:*:*:*:*:pimcore:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-32075

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 36 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-32075

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	2.8	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	2.8	1.4	GitHub, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

CWE ids for CVE-2023-32075

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: security-advisories@github.com (Secondary)

References for CVE-2023-32075

https://github.com/pimcore/customer-data-framework/releases/tag/v3.3.9

Release 3.3.9 · pimcore/customer-data-framework · GitHub
Release Notes
https://huntr.dev/bounties/cecd7800-a996-4f3a-8689-e1c2a1e0248a/

Business Logic Errors in Customer automation rules vulnerability found in pimcore
Exploit;Third Party Advisory
https://github.com/pimcore/customer-data-framework/security/advisories/GHSA-x99j-r8vv-gwwj

Business Logic Errors in Customer automation rules · Advisory · pimcore/customer-data-framework · GitHub
Mitigation;Patch;Vendor Advisory
https://github.com/pimcore/customer-data-framework/commit/e3f333391582d9309115e6b94e875367d0ea7163.patch

Patch

Jump to

Vulnerability Details : CVE-2023-32075

Products affected by CVE-2023-32075

Exploit prediction scoring system (EPSS) score for CVE-2023-32075

CVSS scores for CVE-2023-32075

CWE ids for CVE-2023-32075

References for CVE-2023-32075