CVE-2021-23405

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jul 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-234069.8This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:*CVE-2021-234077.5This affects the package elFinder.Net.Core from 0 and before 1.2.4. The user-controlled file name is not properly sanitized before it is use CVE-2021-234084.3This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked in CVE-2021-234097.5The package github.com/pires/go-proxyproto before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the proxy CVE-2021-23413.1Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that a CVE-2021-234116.1Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the main functionality. It accepts input that can result CVE-2021-234129.8All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the CVE-2021-234135.3This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString,CVE-2021-234146.1This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.CVE-2021-234157.5This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a CVE-2021-234166.1This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input.CVE-2021-234179.8All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.