CVE-2024-29197: Insufficient Information (NVD-CWE-noinfo)
value: Pimcore is an Open Source Data & Experience Management Platform. Any call with the query argument `?pimcore_preview=true` allows to view unpublished sites. In previous versions of Pimcore, session information would propagate to previews, so only a logged in user could open a preview. This no longer applies. Previews are broad open to any user and with just the hint of a restricted link one could gain access to possible confident / unreleased information. This vulnerability is fixed in 11.2.2 and 11.1.6.1.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-26T15:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: bundles/CoreBundle/src/EventListener/Frontend/ElementListener.php
Commit date: 2024-03-25 16:47:10 +0100
Commit message: Merge pull request from GHSA-5737-rqv4-v445

* Do not allow access to preview for non-user.

* Add logger.
Diff: diff --git a/bundles/CoreBundle/src/EventListener/Frontend/ElementListener.php b/bundles/CoreBundle/src/EventListener/Frontend/ElementListener.php
index bb695609727a..f078226504ce 100644
--- a/bundles/CoreBundle/src/EventListener/Frontend/ElementListener.php
+++ b/bundles/CoreBundle/src/EventListener/Frontend/ElementListener.php
@@ -32,10 +32,11 @@ use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Session\SessionInterface;
 use Symfony\Component\HttpKernel\Event\ControllerEvent;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 use Symfony\Component\HttpKernel\KernelEvents;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 
 /**
  * Handles element setup logic from request.
  *
  * @internal
@@ -80,10 +81,18 @@ class ElementListener implements EventSubscriberInterface, LoggerAwareInterface
             $user = null;
             if ($adminRequest) {
                 $user = $this->userLoader->getUser();
             }
 
+            if ($document && !$document->isPublished() && !$user) {
+                $this->logger->warning(
+                    "Denying access to document {$document->getFullPath()} as it is unpublished and there is no user in the session."
+                );
+
+                throw new AccessDeniedHttpException(sprintf('Access denied for %s', $document->getFullPath()));
+            }
+
             // editmode, pimcore_preview & pimcore_version
             if ($user) {
                 $document = $this->handleAdminUserDocumentParams($request, $document, $user);
                 $this->handleObjectParams($request);
             }

Fixed code: use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
            if ($document && !$document->isPublished() && !$user) {
                $this->logger->warning(
                    "Denying access to document {$document->getFullPath()} as it is unpublished and there is no user in the session."
                );

                throw new AccessDeniedHttpException(sprintf('Access denied for %s', $document->getFullPath()));
            }