CVE-2024-29197

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Pimcore is an Open Source Data & Experience Management Platform. Any call with the query argument `?pimcore_preview=true` allows to view unpublished sites. In previous versions of Pimcore, session information would propagate to previews, so only a logged in user could open a preview. This no longer applies. Previews are broad open to any user and with just the hint of a restricted link one could gain access to possible confident / unreleased information. This vulnerability is fixed in 11.2.2 and 11.1.6.1.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Mar 26, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-291988.2GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve ServCVE-2024-291995.3Nautobot is a Network Source of Truth and Network Automation Platform. A number of Nautobot URL endpoints were found to be improperly accessCVE-2024-29205.3The WP-Members Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.4.9.3 duCVE-2024-292006.5Kimai is a web-based multi-user time-tracking application. The permission `view_other_timesheet` performs differently for the Kimai UI and tCVE-2024-292019.9JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation CVE-2024-292029.9JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template inCVE-2024-292036.1TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. CVE-2024-292049.8A Heap Overflow vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to eCVE-2024-292057.5An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti PCVE-2024-292062.2An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported CVE-2024-292077.5An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. AffeCVE-2024-292082.2An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the