Every CVE Search/ Get API key

CVE-2024-41109

Pimcore vulnerable to disclosure of system and database information behind /admin firewall

6.3 MediumFix available

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to /admin/index/statistics with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.48%Up 0.4 points since Jul 31, 2024
90%50%10%1%

What each source reports

CVE List Score used 6.3

Pimcore vulnerable to disclosure of system and database information behind /admin firewall

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to /admin/index/statistics with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.

Record
CVE-2024-41109
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-200
Updated
2026-11-02
EUVDEUVD-2024-2340 6.3

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to /admin/index/statistics with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.

Record
EUVD-2024-2340
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-fx6j-9pp6-ph36 5.3

Pimcore vulnerable to disclosure of system and database information behind /admin firewall

Summary

Navigating to /admin/index/statistics with a logged in Pimcore user (not an XmlHttpRequest because of this check: IndexController:125) exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system.

The web server should not return any product and version information of the components used. The table names and row counts should not be exposed.

Details

/admin/index/statistics returns the following JSON-response:

{
    {
        "instanceId": "...",
        "pimcore_major_version": 11,
        "pimcore_version": "v11.3.1",
        "pimcore_hash": "3ecd39f21dbdd25ffdf4bec6e2c860eccfd3d008",
        "pimcore_platform_version": "v2024.2",
        "php_version": "8.3.8",
        "mysql_version": "10.11.8-MariaDB-ubu2204",
    "bundles": [
        // all installed bundles
    ],
    "tables": [
        // all tables and their row count, e.g:
        {
            "name": "users",
            "rows": 2
        },
    ]
}

Information about the Pimcore Version can also be seen here:

In a current Version:

In Pimcore Version 10.6.9:

PoC

Impact

Only for logged in Pimcore users possible.

Workaround and Patch

We patched the following additional check for Pimcore v10.6.9. This uses an app-specific class but any user permission would be ok. This resolves navigating to /admin/index/statistics.

diff --git a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php
--- a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php    (revision dd81ef4c666b18c254333867a60f6ed455025076)
+++ b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php    (date 1721225746781)
@@ -15,6 +15,7 @@

namespace Pimcore\Bundle\AdminBundle\Controller\Admin;

+use App\Constant\UserPermission;
use Doctrine\DBAL\Connection;
use Exception;
use Pimcore\Analytics\Google\Config\SiteConfigProvider;
@@ -142,6 +143,12 @@
throw $this->createAccessDeniedHttpException();
}

+        $user = $this->tokenResolver->getUser();
+
+        if (!$user->isAdmin() && !$user->isAllowed(UserPermission::ADMIN_INDEX_VIEW)) {
+            throw $this->createAccessDeniedException();
+        }
+
// DB
try {
$tables = $db->fetchAllAssociative('SELECT TABLE_NAME as name,TABLE_ROWS as `rows` from information_schema.TABLES

For the Pimcore versions in the UI we used the IndexActionSettingsEvent. This works for Versions < Pimcore 11:

<?php

namespace App\EventListener\Admin;

use App\Constant\UserPermission;
use Pimcore\Bundle\AdminBundle\Event\AdminEvents;
use Pimcore\Event\Admin\IndexActionSettingsEvent;
use Pimcore\Security\User\TokenStorageUserResolver;
use Symfony\Component\EventDispatcher\EventSubscriberInterface;

/**
* @deprecated and cannot be used in Pimcore 11
*/…
Record
GHSA-fx6j-9pp6-ph36
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-200
Updated
2026-11-02
NVD 6.3

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to /admin/index/statistics with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.

Record
CVE-2024-41109
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSV 6.3

Pimcore vulnerable to disclosure of system and database information behind /admin firewall

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to /admin/index/statistics with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.

Record
CVE-2024-41109
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-200
Updated
2026-11-02
OSVGHSA-fx6j-9pp6-ph36 5.3

Pimcore vulnerable to disclosure of system and database information behind /admin firewall

Summary

Navigating to /admin/index/statistics with a logged in Pimcore user (not an XmlHttpRequest because of this check: IndexController:125) exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system.

The web server should not return any product and version information of the components used. The table names and row counts should not be exposed.

Details

/admin/index/statistics returns the following JSON-response:

{
    {
        "instanceId": "...",
        "pimcore_major_version": 11,
        "pimcore_version": "v11.3.1",
        "pimcore_hash": "3ecd39f21dbdd25ffdf4bec6e2c860eccfd3d008",
        "pimcore_platform_version": "v2024.2",
        "php_version": "8.3.8",
        "mysql_version": "10.11.8-MariaDB-ubu2204",
    "bundles": [
        // all installed bundles
    ],
    "tables": [
        // all tables and their row count, e.g:
        {
            "name": "users",
            "rows": 2
        },
    ]
}

Information about the Pimcore Version can also be seen here:

In a current Version:

In Pimcore Version 10.6.9:

PoC

Impact

Only for logged in Pimcore users possible.

Workaround and Patch

We patched the following additional check for Pimcore v10.6.9. This uses an app-specific class but any user permission would be ok. This resolves navigating to /admin/index/statistics.

diff --git a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php
--- a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php    (revision dd81ef4c666b18c254333867a60f6ed455025076)
+++ b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php    (date 1721225746781)
@@ -15,6 +15,7 @@

namespace Pimcore\Bundle\AdminBundle\Controller\Admin;

+use App\Constant\UserPermission;
use Doctrine\DBAL\Connection;
use Exception;
use Pimcore\Analytics\Google\Config\SiteConfigProvider;
@@ -142,6 +143,12 @@
throw $this->createAccessDeniedHttpException();
}

+        $user = $this->tokenResolver->getUser();
+
+        if (!$user->isAdmin() && !$user->isAllowed(UserPermission::ADMIN_INDEX_VIEW)) {
+            throw $this->createAccessDeniedException();
+        }
+
// DB
try {
$tables = $db->fetchAllAssociative('SELECT TABLE_NAME as name,TABLE_ROWS as `rows` from information_schema.TABLES

For the Pimcore versions in the UI we used the IndexActionSettingsEvent. This works for Versions < Pimcore 11:

<?php

namespace App\EventListener\Admin;

use App\Constant\UserPermission;
use Pimcore\Bundle\AdminBundle\Event\AdminEvents;
use Pimcore\Event\Admin\IndexActionSettingsEvent;
use Pimcore\Security\User\TokenStorageUserResolver;
use Symfony\Component\EventDispatcher\EventSubscriberInterface;

/**
* @deprecated and cannot be used in Pimcore 11
*/…
Record
GHSA-fx6j-9pp6-ph36
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-200
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pimcore/admin-ui-classic-bundle
Packagist
 through 1.5.1
1.5.2
pimcore/admin-ui-classic-bundle
Packagist
 before 1.5.2, plus listed versions
1.4.0v1.0.0v1.0.0-BETA1v1.0.0-RC1v1.0.0-RC2
Show 33 moreShow less
v1.0.1v1.0.2v1.0.3v1.0.4v1.0.5v1.0.6v1.1.0v1.1.0-RC1v1.1.1v1.1.2v1.1.3v1.1.4v1.2v1.2.0-RC1v1.2.1v1.2.2v1.2.3v1.3.0v1.3.0-RC1v1.3.1v1.3.2v1.3.3v1.3.4v1.3.5v1.4.1v1.4.2v1.4.3v1.4.4v1.4.5v1.5.0v1.5.0-RC1v1.5.0-RC2v1.5.1
1.5.2

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-41109 is a medium vulnerability (CVSS 6.3) in Pimcore Admin Classic Bundle, published July 30, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in pimcore/admin-ui-classic-bundle 1.5.2.

References

This page doesn't list everything

Left out here: the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open