Vesh3

**Name of the Vulnerable Software and Affected Versions** Pimcore Customer-data-framework versions prior to 4.0.5 **Description** The issue allows an attacker to create new customers due to the lack of tokens or headers to prevent CSRF attacks. This can be exploited to manage customer data within Pimcore. **Recommendations** For versions prior to 4.0.5, update to version 4.0.5 to resolve the issue. As a temporary workaround, consider implementing additional security measures to prevent CSRF attacks, such as validating requests through other means.

**Name of the Vulnerable Software and Affected Versions** Pimcore versions prior to 10.5.19 **Description** Pimcore is an open source data and experience management platform. Since a user with 'report' permission can already write arbitrary SQL queries and given the fact that an endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. The impact of this issue is limited but when combined with SQL Injection, the exported data can be controlled and a webshell can be uploaded, allowing attackers to execute arbitrary PHP code on the server with the permissions of the webserver. **Recommendations** For versions prior to 10.5.19, upgrade to version 10.5.19 to receive a patch. As a workaround, apply the patch manually. Restrict access to the endpoint using the GET method to minimize the risk of exploitation. Avoid using the `report` permission for users who do not need it until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Pimcore versions prior to 10.5.19 **Description** Pimcore is an open source data and experience management platform. The platform has an unsecured tooltip field in the DataObject class definition. This issue has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. **Recommendations** For versions prior to 10.5.19, upgrade to version 10.5.19. As a temporary workaround for versions prior to 10.5.19, apply the patch manually.

**Name of the Vulnerable Software and Affected Versions** Pimcore versions prior to 10.5.19 **Description** Pimcore is an open source data and experience management platform. An attacker can use cross-site scripting to send a malicious script to an unsuspecting user. **Recommendations** For versions prior to 10.5.19, upgrade to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually.