-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing access control in the DuplicatesController's listAction method handling the /admin/customermanagementframework/duplicates/list endpoint. The proof-of-concept demonstrates unauthorized access, and the patch adds a permission check (checkPermission('plugin_cmf_perm_customerview')) via a new onKernelControllerEvent method. This indicates the original listAction method executed without verifying user permissions, making it the vulnerable function. The direct correlation between the missing check in the original code and the security fix confirms this assessment.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pimcore/customer-management-framework-bundle | composer | < 4.0.6 | 4.0.6 |
PHPPHPOngoing coverage of React2Shell