Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.5epss 1.4%
exploitation probability
1.4%top 29% of all CVEs
observed exploitation
nono source reports it
The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without having to provide the two factor credentials. This issue has been patched in version 1.2.2.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Affected products
pimcore · admin-ui-classic-bundleReferences
https://github.com/pimcore/admin-ui-classic-bundle/commit/e412b0597830ae564a604e2579eb40e76f7f0628https://github.com/pimcore/admin-ui-classic-bundle/pull/345https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-9wwg-r3c7-4vfghttps://patch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch