CVE-2024-29197

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Pimcore is an Open Source Data & Experience Management Platform. Any call with the query argument `?pimcore_preview=true` allows to view unpublished sites. In previous versions of Pimcore, session information would propagate to previews, so only a logged in user could open a preview. This no longer applies. Previews are broad open to any user and with just the hint of a restricted link one could gain access to possible confident / unreleased information. This vulnerability is fixed in 11.2.2 and 11.1.6.1.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
pimcore	pimcore	>= 11.0.0, < 11.1.6.1; >= 11.2.0, < 11.2.2
pimcore	pimcore	>= 11.0.0, < 11.1.6.1; >= 11.2.0, < 11.2.2

References

https://github.com/pimcore/pimcore/commit/3ae43fb1065f9eb62ad2f542b883858d36d57e53Patch
https://github.com/pimcore/pimcore/security/advisories/GHSA-5737-rqv4-v445Exploit, Third Party Advisory
https://github.com/pimcore/pimcore/commit/3ae43fb1065f9eb62ad2f542b883858d36d57e53Patch
https://github.com/pimcore/pimcore/security/advisories/GHSA-5737-rqv4-v445Exploit, Third Party Advisory

Timeline

Published: Mar 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-291988.2GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve Serv CVE-2024-291995.3Nautobot is a Network Source of Truth and Network Automation Platform. A number of Nautobot URL endpoints were found to be improperly access CVE-2024-29205.3The WP-Members Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.4.9.3 du CVE-2024-292006.5Kimai is a web-based multi-user time-tracking application. The permission `view_other_timesheet` performs differently for the Kimai UI and t CVE-2024-292019.9JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation CVE-2024-292029.9JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template in CVE-2024-292036.1TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. CVE-2024-292049.8A Heap Overflow vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to e CVE-2024-292057.5An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti P CVE-2024-292062.2An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported CVE-2024-292077.5An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. Affe CVE-2024-292082.2An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the