Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie session data, and other details can be accessed or recovered through the Pimcore backend. This vulnerability is fixed in 12.3.1 and 11.5.14.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:LPimcore
APPPimcore< 11.5.1412.0.0 – 12.3.1 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References
Related vulnerabilities
CVE-2022-39365CRITICAL9.8PL ✓same product
Pimcore — server-side template injection umożliwiający RCE
CVE-2021-4139CRITICAL9.0PL ✓same product
XSS w Pimcore — podatność Cross-site Scripting
CVE-2019-18985CRITICAL9.8PL ✓same product
Pimcore: brak ochrony przed brute force dla tokenu 2FA
CVE-2019-18981CRITICAL9.8PL ✓same product
Pimcore: brak odmowy dostępu przy nieprawidłowym ID odbiorcy powiadomień
CVE-2026-23492HIGH8.8same product
Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQ...