Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patch manually.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is
    possible to enumerate usernames via the forgot password functionality. This issue is fixed in version
    10.1.3. As a workaround, one may apply the available patch manually. (CVE-2021-39189)

Pimcore versions before 10.1.3 suffer from an user enumeration vulnerability through the administration panel lost password feature. By submitting multiple usernames, a remote and unauthenticated attacker can infer the valid administrative accounts on the target Pimcore instance.

ID	Name	Product	Family	Severity
410652	SCA: security update for pimcore/pimcore (GHSA-579x-cjvr-cqj9)	Tenable Cloud Security	SCA Checks	medium
410652	SCA: security update for pimcore/pimcore (GHSA-579x-cjvr-cqj9)	Tenable Self-Hosted Container Security	SCA Checks	medium
114089	Pimcore User Enumeration	Web App Scanning	Web Applications	medium

Detections

Analytics

CVE-2021-39189

medium

Tenable Plugins

medium

medium

medium