CVE-2023-49076

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an attacker could abuse this vulnerability to create new customers. This issue has been patched in version 4.0.5.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Nov 30, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-490776.1Mailcow: dockerized is an open source groupware/email suite based on docker. A Cross-Site Scripting (XSS) vulnerability has been identified CVE-2023-490786.1raptor-web is a CMS for game server communities that can be used to host information and keep track of players. In version 0.4.4 of raptor-wCVE-2023-490797.5Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonateCVE-2023-49084.3Inappropriate implementation in Picture in Picture in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI viCVE-2023-490804.3The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebooCVE-2023-490815.3aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modiCVE-2023-490825.3aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modCVE-2023-490837.5cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificatesCVE-2023-490848.8Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the deteCVE-2023-490858.8Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SCVE-2023-490865.4Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). A vulnerability in vCVE-2023-490877.5xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash
CVE-2023-49076: Medium severity, CVSS 6.5 | Vulnix