Pimcore vulnerable to Business Logic Errors via Customer automation rules
Impact
Business Logic Errors in the Conditions tab since the counter can be a negative number.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 3.3.9Ecosystem versions | 3.3.9 |
Version evidence: OSV · GHSA-x99j-r8vv-gwwj
View original version evidence (138 explicit versions)
Original source description
Impact
Business Logic Errors in the Conditions tab since the counter can be a negative number.
This vulnerability is capable of the unlogic in the counter value in the Conditions tab.
Patches
Update to version 3.3.9 or apply this patch manually https://github.com/pimcore/customer-data-framework/commit/e3f333391582d9309115e6b94e875367d0ea7163.patch
Workarounds
Apply https://github.com/pimcore/customer-data-framework/commit/e3f333391582d9309115e6b94e875367d0ea7163.patch manually.
References
https://huntr.dev/bounties/cecd7800-a996-4f3a-8689-e1c2a1e0248a/
References
- Security advisory github.com/pimcore/customer-data-framework/security/advisories/GHSA-x99j-r8vv-gwwj
- Security advisory nvd.nist.gov/vuln/detail/CVE-2023-32075
- Patch github.com/pimcore/customer-data-framework/commit/e3f333391582d9309115e6b94e875367d0ea7163.patch
- Source reference github.com/pimcore/customer-data-framework
- Release notes github.com/pimcore/customer-data-framework/releases/tag/v3.3.9
- Source reference huntr.dev/bounties/cecd7800-a996-4f3a-8689-e1c2a1e0248a