What is CVE-2023-49076?

CVE-2023-49076 is a medium-severity vulnerability in Pimcore Customer-data-framework, classified under Cross-Site Request Forgery (CSRF). CVSS score: 4.3/10. Published 2023-11-30.

How severe is CVE-2023-49076?

Medium severity. CVSS v3 base score is 4.3 out of 10.

CSRF in Pimcore Customer-data-framework

CVE-2023-49076

Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an attacker could abuse this vulnerability to create new customers. This issue has…

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.003 (17.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.

Affected products

Pimcore Customer-data-framework — versions < 4.0.5
Pimcore

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Patch, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2023-49076?: CVE-2023-49076 is a medium-severity vulnerability in Pimcore Customer-data-framework, classified under Cross-Site Request Forgery (CSRF). CVSS score: 4.3/10. Published 2023-11-30.
How severe is CVE-2023-49076?: Medium severity. CVSS v3 base score is 4.3 out of 10.