PT-2023-32375

CVE-2023-5844

Published

2023-10-30

Updated

2025-11-28

Description by

CVSS 3.1

4.3

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions pimcore/admin-ui-classic-bundle versions prior to 1.2.0

Description The issue concerns an unverified password change in the GitHub repository pimcore/admin-ui-classic-bundle. This allows an attacker to set an old password as a new password, violating password policy. The problem arises because Pimcore does not enforce a strict password policy.

Recommendations For versions prior to 1.2.0, update to version 1.2.0 or apply the patch manually from https://github.com/pimcore/admin-ui-classic-bundle/commit/498ac77e54541177be27b0c710e387c47b3836ea.patch to resolve the issue.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-620: Unverified Password Change

CWE-287: Improper Authentication

Related identifiers

CVE-2023-5844