CVE-2023-3819

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pimcore/pimcore prior to 10.6.4.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
pimcore	pimcore/pimcore	>= unspecified, < 10.6.4
pimcore	pimcore	< 10.6.4

References

https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54Patch
https://huntr.dev/bounties/be5e4d4c-1b0b-4c01-a1fc-00533135817cExploit, Patch, Third Party Advisory
https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54Patch
https://huntr.dev/bounties/be5e4d4c-1b0b-4c01-a1fc-00533135817cExploit, Patch, Third Party Advisory

Timeline

Published: Jul 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-381908.8An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Export SQL Injection via the size parameter.CVE-2023-381916.1An issue was discovered in SuperWebMailer 9.00.0.01710. It allows spamtest_external.php XSS via a crafted filename.CVE-2023-381926.1An issue was discovered in SuperWebMailer 9.00.0.01710. It allows superadmincreate.php XSS via crafted incorrect passwords.CVE-2023-381938.8An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Remote Code Execution via a crafted sendmail command line.CVE-2023-381946.1An issue was discovered in SuperWebMailer 9.00.0.01710. It allows keepalive.php XSS via a GET parameter.CVE-2023-381954.9Datalust Seq before 2023.2.9489 allows insertion of sensitive information into an externally accessible file or directory. This is exploitab CVE-2023-381977.5An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive CVE-2023-381989.8acme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the wild in June 2023.CVE-2023-381999.8coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. Thi CVE-2023-38207.2SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4.CVE-2023-382007.5A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL co CVE-2023-382016.5A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue