Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
The advisory, in context
Impact
AdminBundle\Security\PimcoreUserTwoFactorCondition introduced in v11 disable the two factor authentication for all non-admin security firewalls.
An authenticated user can access the system without having to provide the 2 factor credentials.
Patches
Apply patch https://patch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch
Workarounds
Upgrade to version 1.2.2 or apply the patch manually.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 1.2.2
Fixed in 1.2.2
19 explicitly affected versions
v1.0.0, v1.0.0-BETA1, v1.0.0-RC1, v1.0.0-RC2, v1.0.1, v1.0.2, v1.0.3, v1.0.4, v1.0.5, v1.0.6, v1.1.0, v1.1.0-RC1, v1.1.1, v1.1.2, v1.1.3, v1.1.4, v1.2, v1.2.0-RC1, v1.2.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v1.0.0",
"v1.0.0-BETA1",
"v1.0.0-RC1",
"v1.0.0-RC2",
"v1.0.1",
"v1.0.2",
"v1.0.3",
"v1.0.4",
"v1.0.5",
"v1.0.6",
"v1.1.0",
"v1.1.0-RC1",
"v1.1.1",
"v1.1.2",
"v1.1.3",
"v1.1.4",
"v1.2",
"v1.2.0-RC1",
"v1.2.1"
]
}References
- https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-9wwg-r3c7-4vfg
- https://nvd.nist.gov/vuln/detail/CVE-2023-49075
- https://github.com/pimcore/admin-ui-classic-bundle/pull/345
- https://github.com/pimcore/admin-ui-classic-bundle/commit/e412b0597830ae564a604e2579eb40e76f7f0628
- https://github.com/pimcore/admin-ui-classic-bundle
- https://patch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch