Skip to content
OpenAdvisories
High · 8.3 CVE-2021-23405 EUVD-2021-1465GHSA-g8jx-66p8-vcm2SNYK-PHP-PIMCOREPIMCORE-1316297

SQL Injection

Published Jul 9, 2021 · Updated Sep 16, 2024 · Assigned by snyk

Description

This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class.

Affected products

VendorProductAffectedFixed
— pimcore/pimcore unspecified – < 10.0.7 10.0.7

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist pimcore/pimcore < 10.0.7 10.0.7 GHSA-g8jx-66p8-vcm2

References