An issue was discovered in Pimcore before 5.7.1.

Summary

An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.

Timeline

1. Apr 4, 2019, 5:51 PM UTCCVE published
2. Apr 30, 2019Public exploit on Exploit-DB

   EDB-46783, EDB-46783

3. Aug 4, 2024, 10:32 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• pimcore/pimcorePackagist

  fixed in 5.7.1

References 8