Back to Database
Status published
Medium
CVE-2023-49076
Pimcore missing token/header to prevent CSRF
Vulnerability Description
Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an attacker could abuse this vulnerability to create new customers. This issue has been patched in version 4.0.5.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-49076
Credits & Attribution
No credits recorded in the NVD database.
References
More from pimcore
View All →CVE-2025-30166
Pimcore's Admin Classic Bundle allows HTML Injection
Low
1.8
CVE-2025-27617
Pimcore Vulnerable to SQL Injection in getRelationFilterCondition
Medium
6.3
CVE-2025-24980
Pimcore Admin Classic Bundle allows user enumeration
Medium
6.9
CVE-2024-49370
Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing
High
8.7
CVE-2024-41109
Pimcore vulnerable to disclosure of system and database information behind /admin firewall
Medium
6.3
Affected Vendor
pimcore
View all reports →Affected Software
customer-data-framework
Vulnerable Versions:
< 4.0.5
Timeline
Official Publish:
November 30th, 2023
Last Modified:
June 5th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N