CVE-2023-28438

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
pimcore	pimcore	< 10.5.19

References

https://github.com/pimcore/pimcore/commit/d1abadb181c88ebaa4bce1916f9077469d4ea2bc.patchPatch
https://github.com/pimcore/pimcore/pull/14526Patch, Vendor Advisory
https://github.com/pimcore/pimcore/security/advisories/GHSA-vf7q-g2pv-jxvxPatch, Vendor Advisory
https://github.com/pimcore/pimcore/commit/d1abadb181c88ebaa4bce1916f9077469d4ea2bc.patchPatch
https://github.com/pimcore/pimcore/pull/14526Patch, Vendor Advisory
https://github.com/pimcore/pimcore/security/advisories/GHSA-vf7q-g2pv-jxvxPatch, Vendor Advisory

Timeline

Published: Mar 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-284396.1CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Ifr CVE-2023-28444.9Authorization Bypass Through User-Controlled Key in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.CVE-2023-284402.7Discourse is an open source platform for community discussion. In affected versions a maliciously crafted request from a Discourse administr CVE-2023-284417.5smartCARS 3 is flight tracking software. In version 0.5.8 and prior, all persons who have failed login attempts will have their password sto CVE-2023-284425.3GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Prior to versions 2.20.CVE-2023-284435.5Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is no CVE-2023-284447.5angular-server-side-configuration helps configure an angular application at runtime on the server or in a docker container via environment v CVE-2023-284459.8Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions t CVE-2023-284468.8Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without CVE-2023-284476.1Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vul CVE-2023-284487.5Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast des CVE-2023-28458.1Improper Access Control in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.