Detections
Analytics

SCA: security update for pimcore/admin-ui-classic-bundle (GHSA-3qpq-6w89-f7mx)

critical Tenable Self-Hosted Container Security Plugin ID 409663

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential security vulnerability has
 been discovered in `pimcore/admin-ui-classic-bundle` prior to version 1.3.4. The vulnerability involves a
 Host Header Injection in the `invitationLinkAction` function of the UserController, specifically in the
 way `$loginUrl` trusts user input. The host header from incoming HTTP requests is used unsafely when
 generating URLs. An attacker can manipulate the HTTP host header in requests to the
 /admin/user/invitationlink endpoint, resulting in the generation of URLs with the attacker's domain. In
 fact, if a host header is injected in the POST request, the $loginURL parameter is constructed with this
 unvalidated host header. It is then used to send an invitation email to the provided user. This
 vulnerability can be used to perform phishing attacks by making the URLs in the invitation links emails
 point to an attacker-controlled domain. Version 1.3.4 contains a patch for the vulnerability. The
 maintainers recommend validating the host header and ensuring it matches the application's domain. It
 would also be beneficial to use a default trusted host or hostname if the incoming host header is not
 recognized or is absent. (CVE-2024-25625)

Solution

Update the pimcore/admin-ui-classic-bundle library and its related packages to version 1.3.4 or later.

See Also

https://github.com/advisories/GHSA-3qpq-6w89-f7mx

Plugin Details

Severity: Critical

ID: 409663

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.8

Percentile: 57.36

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2024-25625

CVSS v3

Risk Factor: Critical

Base Score: 9.3

Temporal Score: 8.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/20/2024

Vulnerability Publication Date: 2/19/2024

Reference Information

CVE: CVE-2024-25625

cwe: CWE-74