CVE-2023-2756
SQL Injection in pimcore/customer-data-framework
SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
SQL Injection in pimcore/customer-data-framework
SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10.
- Record
CVE-2023-2756- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2023-1441
SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10.
- Record
EUVD-2023-1441- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-25fx-3c2q-cq46
pimcore/customer-management-framework-bundle has SQL Injection vulnerability in Segment Assignment query
Impact
An administrator user can use the inheritable segments feature to execute his own blind SQL queries.
A user with administrator privileges can run any SQL query on database. This can be used to retrieve sensitive data, change database information or any other malicious activity against the database.
Patches
Update to version 3.3.10 or apply this patch manually https://github.com/pimcore/customer-data-framework/commit/76df151737b7964ce5169fdf9e27a0ad801757fe.patch
Workarounds
Apply https://github.com/pimcore/customer-data-framework/commit/76df151737b7964ce5169fdf9e27a0ad801757fe.patch manually.
References
https://huntr.dev/bounties/cf398528-819f-456e-88e7-c06d268d3f44/
- Record
GHSA-25fx-3c2q-cq46- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
NVD
SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10.
- Record
CVE-2023-2756- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
SQL Injection in pimcore/customer-data-framework
SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10.
- Record
CVE-2023-2756- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVGHSA-25fx-3c2q-cq46
pimcore/customer-management-framework-bundle has SQL Injection vulnerability in Segment Assignment query
Impact
An administrator user can use the inheritable segments feature to execute his own blind SQL queries.
A user with administrator privileges can run any SQL query on database. This can be used to retrieve sensitive data, change database information or any other malicious activity against the database.
Patches
Update to version 3.3.10 or apply this patch manually https://github.com/pimcore/customer-data-framework/commit/76df151737b7964ce5169fdf9e27a0ad801757fe.patch
Workarounds
Apply https://github.com/pimcore/customer-data-framework/commit/76df151737b7964ce5169fdf9e27a0ad801757fe.patch manually.
References
https://huntr.dev/bounties/cf398528-819f-456e-88e7-c06d268d3f44/
- Record
GHSA-25fx-3c2q-cq46- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pimcore/customer-management-framework-bundlePackagist |
before 3.3.10 | 3.3.10 |
pimcore/customer-management-framework-bundlePackagist |
before 3.3.10, plus listed versions 1.3.172.4.5v1.0.0v1.0.1v1.1.0 Show 45 moreShow lessv1.1.1v1.10.0v1.10.1v1.11.0v1.12.0v1.12.1v1.13.0v1.13.1v1.14.0v1.14.1v1.14.2v1.14.3v1.14.4v1.2.0v1.2.1v1.2.2v1.2.3v1.2.4v1.2.5v1.2.6v1.3.0v1.3.1v1.3.10v1.3.11v1.3.12v1.3.13v1.3.14v1.3.15v1.3.16v1.3.18v1.3.19v1.3.2v1.3.20v1.3.21v1.3.3v1.3.4v1.3.5v1.3.6v1.3.7v1.3.8v1.3.9v1.4.0v1.4.1v1.4.10v1.4.11 |
3.3.10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-2756 is a medium vulnerability (CVSS 6.5) in Pimcore Pimcore/customer-data-framework, published May 17, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.94%, the 60th percentile. Fixed in pimcore/customer-management-framework-bundle 3.3.10.
References
huntr.dev/bounties/cf398528-819f-456e-88e7-c06d268d3f44
github.com/pimcore/customer-data-framework/commit/76df151737b7964ce5169fdf9e27a0ad801757fe
nvd.nist.gov/vuln/detail/CVE-2023-2756
Left out here: 89 versions. The JSON record has them.