CVE-2023-32075: Improper Input Validation
The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management. In pimcore/customer-management-framework-bundle prior to version 3.3.9, business logic errors are possible in the Conditions tab since the counter can be a negative number. This vulnerability is capable of the unlogic in the counter value in the Conditions tab. Users should update to version 3.3.9 to receive a patch or, as a workaround, or apply the patch manually.
References
- github.com/advisories/GHSA-x99j-r8vv-gwwj
- github.com/pimcore/customer-data-framework/commit/e3f333391582d9309115e6b94e875367d0ea7163.patch
- github.com/pimcore/customer-data-framework/releases/tag/v3.3.9
- github.com/pimcore/customer-data-framework/security/advisories/GHSA-x99j-r8vv-gwwj
- huntr.dev/bounties/cecd7800-a996-4f3a-8689-e1c2a1e0248a/
- nvd.nist.gov/vuln/detail/CVE-2023-32075
Code Behaviors & Features
Detect and mitigate CVE-2023-32075 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →