Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.9
CVE-2024-11956: Pimcore Customer Management Framework can be hijacked via SQL injection
CVE-2024-11956 · published 1 year ago
Summary
The part of Pimcore that handles customer lists lets an attacker send specially crafted data that runs unwanted commands on the database. This can be done from anywhere on the internet and may expose or alter your customer information. Update Pimcore to version 4.2.1 as soon as possible to close the gap.
What to do
- Update pimcore customer-management-framework-bundle to version 4.2.1.
- Update pimcore pimcore/customer-management-framework-bundle to version 4.2.1.
- Update pimcore pimcore to version 4.2.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | pimcore | customer-management-framework-bundle |
< 4.2.1 Fix: upgrade to 4.2.1
|
| – | pimcore | pimcore |
< 4.2.1 cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:* |
| Packagist | pimcore | pimcore/customer-management-framework-bundle |
< 4.2.1 Fix: upgrade to 4.2.1
|
Original advisory text
Pimcore customer-data-framework list sql injection
A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0. Affected by this issue is some unknown functionality of the file /admin/customermanagementframework/customers/list. The manipulation of the argument filterDefinition/filter leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component.
References
- https://github.com/advisories/GHSA-q53r-9hh9-w277
- https://github.com/pimcore/pimcore Product
- https://nvd.nist.gov/vuln/detail/CVE-2024-11956 Vendor Advisory
- https://vuldb.com/?id.293906 Vendor Advisory
- https://vuldb.com/?submit.451863 Vendor Advisory
- https://vuldb.com/?ctiid.293906 Third Party Advisory
- https://github.com/pimcore/customer-data-framework/releases/tag/v4.2.1 Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11956... Vendor Advisory
- https://github.com/pimcore/pimcore/security/advisories/GHSA-q53r-9hh9-w277 Exploit
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.9
High
Type
CWE-564SQL Injection: Hibernate
CWE-74Injection
CWE-89SQL Injection
Timeline
Published28 Jan 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-q53r-9hh9-w277 · GHSA
CVE-2024-11956 · NVD
GHSA-q53r-9hh9-w277 · OSV
CVE-2024-11956 · OSV
Track software like this
Free during beta