Every CVE Search/ Get API key

CVE-2023-28438

Pimcore vulnerable to improper quoting of filters in Custom Reports

6.2 MediumFix available

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.86%Up 0.8 points since Mar 23, 2023
90%50%10%1%

What each source reports

CVE List Score used 6.2

Pimcore vulnerable to improper quoting of filters in Custom Reports

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually.

Record
CVE-2023-28438
CVSS 3.1
6.2 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-89
Updated
2026-11-02
EUVDEUVD-2023-1109 6.2

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually.

Record
EUVD-2023-1109
CVSS 3.1
6.2 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-vf7q-g2pv-jxvx 6.2

Pimcore vulnerable to improper quoting of filters in Custom Reports

Impact

Since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link.

The impact of this path traversal and arbitrary extension is limited (creation of arbitrary files and appending data to existing files) but when combined with the SQL Injection, the exported data can be controlled and a webshell can be uploaded. Attackers can use that to execute arbitrary PHP code on the server with the permissions of the webserver.

Patches

Update to version 10.5.19 or apply these patch manually https://github.com/pimcore/pimcore/commit/d1abadb181c88ebaa4bce1916f9077469d4ea2bc.patch https://github.com/pimcore/pimcore/commit/7f788fa44bc18bc1c9182c25e26b770a1d30b62f.patch

Workarounds

Apply patches manually: https://github.com/pimcore/pimcore/commit/d1abadb181c88ebaa4bce1916f9077469d4ea2bc.patch https://github.com/pimcore/pimcore/commit/7f788fa44bc18bc1c9182c25e26b770a1d30b62f.patch

References

#14526 #14498

Record
GHSA-vf7q-g2pv-jxvx
CVSS 3.1
6.2 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-89
Updated
2026-11-02
NVD 6.2

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually.

Record
CVE-2023-28438
CVSS 3.1
6.2 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
OSV 6.2

Pimcore vulnerable to improper quoting of filters in Custom Reports

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually.

Record
CVE-2023-28438
CVSS 3.1
6.2 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-89
Updated
2026-11-02
OSVGHSA-vf7q-g2pv-jxvx 6.2

Pimcore vulnerable to improper quoting of filters in Custom Reports

Impact

Since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link.

The impact of this path traversal and arbitrary extension is limited (creation of arbitrary files and appending data to existing files) but when combined with the SQL Injection, the exported data can be controlled and a webshell can be uploaded. Attackers can use that to execute arbitrary PHP code on the server with the permissions of the webserver.

Patches

Update to version 10.5.19 or apply these patch manually https://github.com/pimcore/pimcore/commit/d1abadb181c88ebaa4bce1916f9077469d4ea2bc.patch https://github.com/pimcore/pimcore/commit/7f788fa44bc18bc1c9182c25e26b770a1d30b62f.patch

Workarounds

Apply patches manually: https://github.com/pimcore/pimcore/commit/d1abadb181c88ebaa4bce1916f9077469d4ea2bc.patch https://github.com/pimcore/pimcore/commit/7f788fa44bc18bc1c9182c25e26b770a1d30b62f.patch

References

#14526 #14498

Record
GHSA-vf7q-g2pv-jxvx
CVSS 3.1
6.2 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-89
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pimcore/pimcore
Packagist
 before 10.5.19
10.5.19
pimcore/pimcore
Packagist
 before 10.5.19, plus listed versions
10.0.82.2.02.2.12.2.22.3.0
Show 45 moreShow less
3.0.03.0.13.0.23.0.33.0.43.0.53.0.63.1.03.1.14.0.04.0.14.1.04.1.14.1.24.1.34.2.04.3.04.3.14.4.04.4.14.4.24.4.34.5.04.6.04.6.14.6.24.6.34.6.44.6.5v10.0.0v10.0.0-BETA1v10.0.0-BETA2v10.0.0-BETA3v10.0.0-BETA4v10.0.1v10.0.2v10.0.3v10.0.4v10.0.5v10.0.6v10.0.7v10.0.9v10.1.0v10.1.1v10.1.2
10.5.19

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-28438 is a medium vulnerability (CVSS 6.2) in Pimcore, published March 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.86%, the 58th percentile. Fixed in pimcore/pimcore 10.5.19.

References

This page doesn't list everything

Left out here: 159 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open