PT-2022-24932

CVE-2022-39365

Published

2022-10-27

Updated

2022-10-31

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 10.5.9

Description The user-controlled twig templates rendering in Pimcore/Mail and ClassDefinitionLayoutText is vulnerable to server-side template injection, which could lead to remote code execution.

Recommendations For versions prior to 10.5.9, update to version 10.5.9 to resolve the issue. As a temporary workaround for versions prior to 10.5.9, apply the patch manually.

Exploitability

Exploit

Fix

Impacts

Researchers

Nth347

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers

CVE-2022-39365