CyberRota Analysis
AI-GeneratedThe WebDAV asset endpoint in Pimcore versions prior to 11.5.17 (LTS) and 12.3.7 is vulnerable to unauthorized asset manipulation, including deletion, movement, and overwriting, due to a lack of proper authentication and permission checks. This vulnerability poses a significant risk to organizations using Pimcore, as it could lead to the loss or corruption of critical data assets. Users of affected versions should prioritize upgrading to the patched releases to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, Pimcore's WebDAV asset endpoint exposes a MOVE operation through /asset/webdav{path} without an authentication plugin in bundles/CoreBundle/src/Controller/WebDavController.php, and models/Asset/WebDAV/Tree.php performs asset mutation and deletion through models/Asset.php before checking a current Pimcore user or the rename, delete, create, or publish permissions, allowing unauthorized asset deletion, moves, or overwrites. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.