CVE-2023-49076

Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an attacker could abuse this vulnerability to create new customers. This issue has been patched in version 4.0.5.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS

0.26% chance of exploitation in the next 30 days, 17th percentile

Published

2023-11-30

Updated

2025-06-05

Proof-of-concept exploits (1)

• pimcore/customer-data-framework/security/advisories/GHSA-xx63-4jr8-9ghc

References

• CVE Record
• NVD entry

Related

• CVE-2023-47637
• CVE-2024-11954
• CVE-2024-11956
• CVE-2024-21665
• CVE-2024-21666
• CVE-2024-21667