CVE-2023-49076

Published November 30th, 2023

View on NVD ↗

CVSS v3

4.3

MEDIUM

CVSS v2

N/A

Affected

PROJECT

Description

Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an attacker could abuse this vulnerability to create new customers. This issue has been patched in version 4.0.5.

pimcore/customer-data-framework

Customer Data Framework community bundle adds capability for management of customer data to Pimcore.

GitHub