CVE-2014-2921
Pimcore Vulnerable to PHP Object Injection Attacks
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a Zend_Pdf_ElementFactory_Proxy object and a pathname with a trailing \0 character.
Exploit likelihood
What each source reports
NVD Score used
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a Zend_Pdf_ElementFactory_Proxy object and a pathname with a trailing \0 character.
- Record
CVE-2014-2921- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a Zend_Pdf_ElementFactory_Proxy object and a pathname with a trailing \0 character.
- Record
CVE-2014-2921- Updated
- 2026-11-02
EUVDEUVD-2022-3919 No score
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a Zend_Pdf_ElementFactory_Proxy object and a pathname with a trailing \0 character.
- Record
EUVD-2022-3919- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g7pj-3v97-3vxp
Pimcore Vulnerable to PHP Object Injection Attacks
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a Zend_Pdf_ElementFactory_Proxy object and a pathname with a trailing \0 character.
- Record
GHSA-g7pj-3v97-3vxp- CVSS 4.0
- 8.9 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-g7pj-3v97-3vxp
Pimcore Vulnerable to PHP Object Injection Attacks
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a Zend_Pdf_ElementFactory_Proxy object and a pathname with a trailing \0 character.
- Record
GHSA-g7pj-3v97-3vxp- CVSS 4.0
- 8.9 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pimcore/pimcorePackagist |
1.4.9 up to 2.2.0 | 2.2.0 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Pimcore CMS 1.4.9 <2.1.0 - Multiple Vulnerabilities | 2014-10-12 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-2921 is a high vulnerability (CVSS 7.5) in Pimcore, published April 21, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.38%, the 93rd percentile. Fixed in pimcore/pimcore 2.2.0.
References
pimcore.org/en/resources/blog/pimcore+2.2+released_b442
openwall.com/lists/oss-security/2014/04/21/1
github.com/pedrib/PoC/blob/master/pimcore-2.1.0.txt
nvd.nist.gov/vuln/detail/CVE-2014-2921