CVE-2023-5844

Name of the Vulnerable Software and Affected Versions pimcore/admin-ui-classic-bundle versions prior to 1.2.0

Description The issue concerns an unverified password change in the GitHub repository pimcore/admin-ui-classic-bundle. This allows an attacker to set an old password as a new password, violating password policy. The problem arises because Pimcore does not enforce a strict password policy.

Recommendations For versions prior to 1.2.0, update to version 1.2.0 or apply the patch manually from https://github.com/pimcore/admin-ui-classic-bundle/commit/498ac77e54541177be27b0c710e387c47b3836ea.patch to resolve the issue.