p PatchFirst

CVE-2024-24822

CVE-2024-24822 · Pimcore Admin Classic Bundle permissions are not getting checked when working with tags

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. tags without having the permission to do so. A fix is available in version 1.3.3. As a workaround, one may apply the patch manually.

CVSS 6.5 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • admin-ui-classic-bundle

    Versions
    • < 1.3.3: Affected

    No fix published

  • pimcore/admin-ui-classic-bundle Packagist

    Versions
    • v1.0.0
    • v1.0.0-BETA1
    • v1.0.0-RC1
    • v1.0.0-RC2
    • v1.0.1
    • v1.0.2
    • v1.0.3
    • v1.0.4
    • v1.0.5
    • v1.0.6
    • v1.1.0
    • v1.1.0-RC1
    • v1.1.1
    • v1.1.2
    • v1.1.3
    • v1.1.4
    • v1.2
    • v1.2.0-RC1
    • v1.2.1
    • v1.2.2
    • v1.2.3
    • v1.3.0
    • v1.3.0-RC1
    • v1.3.1
    • v1.3.2
    Affected ranges
    • ECOSYSTEM: < 1.3.3

    Update to 1.3.3

Original sources

Check your server →