CVE-2014-2922
published 2014-04-21CVE-2014-2922: The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object…
PriorityP342medium6.4CVSS 2.0
AVNACLAuNCNIPAP
EXPLOIT
EPSS
2.90%
85.2th percentile
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtained by unserializing a pathname, which allows remote attackers to conduct PHP object injection attacks and delete arbitrary files via vectors involving a Zend_Http_Response_Stream object.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| pimcore | pimcore | — | — |
| pimcore | pimcore | — | — |
| pimcore | pimcore | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
http://openwall.com/lists/oss-security/2014/04/21/1http://www.pimcore.org/en/resources/blog/pimcore+2.2+released_b442https://github.com/pedrib/PoC/blob/master/pimcore-2.1.0.txthttp://openwall.com/lists/oss-security/2014/04/21/1http://www.pimcore.org/en/resources/blog/pimcore+2.2+released_b442https://github.com/pedrib/PoC/blob/master/pimcore-2.1.0.txt
2014-04-21
Published