Back to Database
Status published
Medium
CVE-2024-41109
Pimcore vulnerable to disclosure of system and database information behind /admin firewall
Vulnerability Description
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-41109
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36
- https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0
- https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40
- https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2
More from pimcore
View All →CVE-2025-30166
Pimcore's Admin Classic Bundle allows HTML Injection
Low
1.8
CVE-2025-27617
Pimcore Vulnerable to SQL Injection in getRelationFilterCondition
Medium
6.3
CVE-2025-24980
Pimcore Admin Classic Bundle allows user enumeration
Medium
6.9
CVE-2024-49370
Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing
High
8.7
CVE-2024-32871
Pimcore Vulnerable to Flooding Server with Thumbnail files
High
7.5
Affected Vendor
pimcore
View all reports →Affected Software
admin-ui-classic-bundle
Vulnerable Versions:
< 1.5.2
Timeline
Official Publish:
July 30th, 2024
Last Modified:
August 2nd, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L