CVE-2024-24822

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. tags without having the permission to do so. A fix is available in version 1.3.3. As a workaround, one may apply the patch manually.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Feb 7, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-248234.4Graylog is a free and open log management platform. Starting in version 4.3.0 and prior to versions 5.1.11 and 5.2.4, reauthenticating with CVE-2024-248248.8Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can CVE-2024-248257.5DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. Th CVE-2024-248265.0Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds CVE-2024-248277.5Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an CVE-2024-248287.8pkg is tool design to bundle Node.js projects into an executables. Any native code packages built by `pkg` are written to a hardcoded direct CVE-2024-248295.3Sentry is an error tracking and performance monitoring platform. Sentry’s integration platform provides a way for external services to inter CVE-2024-24834.3A vulnerability, which was classified as problematic, has been found in Surya2Developer Hostel Management Service 1.0. This issue affects so CVE-2024-248308.8OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulne CVE-2024-248315.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leap13 Premium Addons for Elementor pr CVE-2024-248327.5Missing Authorization vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.9.CVE-2024-248338.8Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons.This issue affects Happy Addons for El