Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2023-23937 Details

Description

Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. The upload functionality for updating user profile does not properly validate the file content-type, allowing any authenticated user to bypass this security check by adding a valid signature (p.e. GIF89) and sending any invalid content-type. This could allow an authenticated attacker to upload HTML files with JS content that will be executed in the context of the domain. This issue has been patched in version 10.5.16.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/pimcore/pimcore/commit/75a448ef8ac74424cf4e723afeb6d05f9eed872f CVEPatch
https://github.com/pimcore/pimcore/security/advisories/GHSA-8xv4-jj4h-qww6 CVEPatchVendor Advisory
https://github.com/pimcore/pimcore/commit/75a448ef8ac74424cf4e723afeb6d05f9eed872f [email protected]Patch
https://github.com/pimcore/pimcore/security/advisories/GHSA-8xv4-jj4h-qww6 [email protected]PatchVendor Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-434Unrestricted Upload of File with Dangerous Type[email protected]

Affected Products

ProductVersions
pimcore pimcore
< 10.5.16

CPE

  • cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

6 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2023-23937
NVD Published Date:
Feb 3, 2023
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2023-23937 Details - Not Deferred