Packagist/pimcore/customer-management-framework-bundle CVE-2024-21667: medium 6.5, EPSS 0.59%
Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts
Action: Upgrade pimcore/customer-management-framework-bundle to 4.0.6 or later.
composer require pimcore/customer-management-framework-bundle:4.0.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.0.6 | - |
Fixed versions
| 4.0.6 |
Sources
- osv: GHSA-g273-wppx-82w4
- https://github.com/pimcore/customer-data-framework/security/advisories/GHSA-g273-wppx-82w4
- https://nvd.nist.gov/vuln/detail/CVE-2024-21667
- https://github.com/pimcore/customer-data-framework/commit/6c34515be2ba39dceee7da07a1abf246309ccd77
- https://github.com/pimcore/customer-data-framework
- https://github.com/pimcore/customer-data-framework/blob/b4af625ef327c58d05ef7cdf145fa749d2d4195e/src/Controller/Admin/GDPRDataController.php#L38
CVE-2024-21667 · published · modified · JSON