CVE-2024-21665

MEDIUM

Pimcore E-commerce Framework < 1.0.10 - Improper Access Control

Title source: rule

Description

ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Access control and permissions are not being enforced. This vulnerability has been patched in version 1.0.10.

References (4)

Core 4

Core References

Exploit, Vendor Advisory x_refsource_confirm

https://github.com/pimcore/ecommerce-framework-bundle/security/advisories/GHSA-cx99-25hr-5jxf

Patch x_refsource_misc

https://github.com/pimcore/ecommerce-framework-bundle/commit/05dec000ed009828084d05cf686f468afd1f464e

View Patch ZIP pw:eip

Issue Tracking x_refsource_misc

https://github.com/pimcore/ecommerce-framework-bundle/blob/ff6ff287b6eb468bb940909c56970363596e5c21/src/Controller/AdminOrderController.php#L98

View Writeup ZIP pw:eip

Release Notes x_refsource_misc

https://github.com/pimcore/ecommerce-framework-bundle/releases/tag/v1.0.10

Scores

CVSS v3 4.3

EPSS 0.0001

EPSS Percentile 0.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-284

Status published

Products (2)

pimcore/e-commerce_framework < 1.0.10

pimcore/ecommerce-framework-bundle 0 - 1.0.10Packagist

Published Jan 11, 2024

Tracked Since Feb 18, 2026