CVE-2024-21665

Packagist/pimcore/ecommerce-framework-bundle CVE-2024-21665: medium 4.3, EPSS 0.49%

Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list

Action: Upgrade pimcore/ecommerce-framework-bundle to 1.0.10 or later.

composer require pimcore/ecommerce-framework-bundle:1.0.10

Affected

Fixed versions

Sources

• osv: GHSA-cx99-25hr-5jxf
• https://github.com/pimcore/ecommerce-framework-bundle/security/advisories/GHSA-cx99-25hr-5jxf
• https://nvd.nist.gov/vuln/detail/CVE-2024-21665
• https://github.com/pimcore/ecommerce-framework-bundle/commit/05dec000ed009828084d05cf686f468afd1f464e
• https://github.com/pimcore/ecommerce-framework-bundle
• https://github.com/pimcore/ecommerce-framework-bundle/blob/ff6ff287b6eb468bb940909c56970363596e5c21/src/Controller/AdminOrderController.php#L98
• https://github.com/pimcore/ecommerce-framework-bundle/releases/tag/v1.0.10

CVE-2024-21665 · published 2024-01-10T15:14:38Z · modified 2026-09-10T03:50:00.272728293Z · JSON