CVE-2024-23648
CVSS 3.1 Score 8.8 of 10 (high)
Details
Summary
CVE-2024-23648 is a vulnerability affecting Pimcore's Admin Classic Bundle, which provides a backend user interface. Before version 1.2.3, the password reset feature sent users an email with a URL containing a token to reset their passwords. Malicious actors could exploit this vulnerability by intercepting the email and manipulating the "Host" HTTP header to redirect users to their own malicious websites. If a user clicked on the link, the attacker would obtain the sensitive reset token and take over the user's account. With version 1.2.3, this issue has been resolved.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Pimcore Admin Classic Bundle
Affected Vendors
- Pimcore
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions