CVE-2023-23937 - CVE House

Back to Database

Status published High CVE-2023-23937

Missing file upload type validation in pimcore/pimcore

8.2 CVSS

Vulnerability Description

Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. The upload functionality for updating user profile does not properly validate the file content-type, allowing any authenticated user to bypass this security check by adding a valid signature (p.e. GIF89) and sending any invalid content-type. This could allow an authenticated attacker to upload HTML files with JS content that will be executed in the context of the domain. This issue has been patched in version 10.5.16.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-23937

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from pimcore

View All →

Pimcore's Admin Classic Bundle allows HTML Injection

Pimcore Vulnerable to SQL Injection in getRelationFilterCondition

Pimcore Admin Classic Bundle allows user enumeration

Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing

Pimcore vulnerable to disclosure of system and database information behind /admin firewall

Affected Vendor

pimcore

View all reports →

Affected Software

pimcore

Vulnerable Versions:

< 10.5.16

Timeline

Official Publish: February 3rd, 2023

Last Modified: March 10th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1059 Command and Scripting Interpreter

T1565.002 Stored Data Manipulation