GHSA-9wwg-r3c7-4vfgHighCVSS 8.4

Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls

Published
November 27, 2023
Last Modified
November 28, 2023

🔗 CVE IDs covered (1)

CVE-2023-49075 →

📋 Description

Impact

AdminBundle\Security\PimcoreUserTwoFactorCondition introduced in v11 disable the two factor authentication for all non-admin security firewalls.

An authenticated user can access the system without having to provide the 2 factor credentials.

Patches

Apply patch https://patch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch

Workarounds

Upgrade to version 1.2.2 or apply the patch manually.

🎯 Affected products1

  • composer/pimcore/admin-ui-classic-bundle:< 1.2.2

🔗 References (6)