CVE-2014-2921

The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a Zend_Pdf_ElementFactory_Proxy object and a pathname with a trailing \0 character.

CVSS v4.0

8.9 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

7.32% chance of exploitation in the next 30 days, 94th percentile

Published

2014-04-21

Updated

2024-08-06

Proof-of-concept exploits (1)

• pedrib/PoC/blob/master/pimcore-2.1.0.txt

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/43886

References

• CVE Record
• NVD entry

Related

• CVE-2014-1201
• CVE-2014-1836
• CVE-2014-2922
• CVE-2014-7862
• CVE-2016-6598
• CVE-2016-6599