CVE-2019-10867

An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.
Configurations

Configuration 1 (hide)

cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-04-04 18:29

Updated : 2023-12-10 12:59


NVD link : CVE-2019-10867

Mitre link : CVE-2019-10867

CVE.ORG link : CVE-2019-10867


JSON object : View

Products Affected

pimcore

  • pimcore
CWE
CWE-502

Deserialization of Untrusted Data