hitoshura25/cvefixes huggingface dataset:
CVE-2015-4425 (PHP, published 2015-08-18T17:59Z)
Description: value: Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. (dot dot) in the dir parameter to admin/asset/add-asset-compatibility.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/pimcore/pimcore
Files changed:
pimcore/modules/admin/controllers/AssetController.php
Commit message: AssetController: directory traversal vulnerability issue

git-svn-id: http://www.pimcore.org/svn/pimcore/private/core/trunk@6458 1f8fe7d8-47f0-464c-8d0a-336f4953ab05


Vulnerable code:

Fixed code:
            // check if the path is outside of the asset directory
            $newRealPath = PIMCORE_ASSET_DIRECTORY . $newPath;
            $newRealPath= realpath($newRealPath);
            if (strpos($newRealPath, PIMCORE_ASSET_DIRECTORY) !== 0) {
                throw new Exception("not allowed");
            }
CVE-2015-4426 (PHP, published 2015-08-18T17:59Z)
Description: value: SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid-proxy.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/pimcore/pimcore
Files changed:
pimcore/modules/admin/controllers/AssetController.php
Commit message: fixed sql injection issue

git-svn-id: http://www.pimcore.org/svn/pimcore/private/core/trunk@6460 1f8fe7d8-47f0-464c-8d0a-336f4953ab05


Vulnerable code:
            // get list of objects
                    $conditionFilters[] =  $field . $operator . " '" . $value . "' ";

Fixed code:
            $db = \Pimcore\Resource::get();
                // get list of objects
                    $conditionFilters[] =  $field . $operator . " " . $db->quote($value);
CVE-2019-10867 (PHP, published 2019-04-04T18:29Z)
Description: value: An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php
Commit message: [Object] optimized bulk import


Vulnerable code:
        $tmpName = PIMCORE_SYSTEM_TEMP_DIRECTORY . '/bulk-import.tmp';
                    $name = serialize($layoutData);
        $response = $this->adminJson(['success' => true, 'filename' => $tmpName, 'data' => $result]);
        $filename = $request->get('filename');
                $layoutData = unserialize($data['name']);

Fixed code:
use Pimcore\Tool\Session;
use Symfony\Component\HttpFoundation\Session\Attribute\AttributeBagInterface;
        $tmpName = PIMCORE_SYSTEM_TEMP_DIRECTORY . '/bulk-import-' . uniqid() . '.tmp';
        Session::useSession(function (AttributeBagInterface $session) use ($tmpName) {
            $session->set('class_bulk_import_file', $tmpName);
        }, 'pimcore_objects');

                    $name = json_encode($layoutData);
        $response = $this->adminJson(['success' => true, 'data' => $result]);
        $session = Session::get('pimcore_objects');
        $filename = $session->get('class_bulk_import_file');
                $layoutData = json_decode($data['name'], true);
CVE-2019-16317 (PHP, published 2019-09-14T18:15Z)
Description: value: In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var/assets/ directory, a different vulnerability than CVE-2019-10867 and CVE-2019-16318.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/pimcore/pimcore
Files changed:
models/Asset.php
Commit message: [Asset] do not allow PHAR upload


Vulnerable code:
        if (preg_match("@\.ph(p[\d+]?|t|tml|ps)$@i", $this->getFilename()) || $this->getFilename() == '.htaccess') {

Fixed code:
        if (preg_match("@\.ph(p[\d+]?|t|tml|ps|ar)$@i", $this->getFilename()) || $this->getFilename() == '.htaccess') {
CVE-2019-16318 (PHP, published 2019-09-14T18:15Z)
Description: value: In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2019-10867 and CVE-2019-16317.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/pimcore/pimcore
Files changed:
models/Asset.php
Commit message: [Asset] do not allow filenames longer than 255 characters


Vulnerable code:

Fixed code:
        if(mb_strlen($this->getFilename()) > 255) {
            throw new \Exception('Filenames longer than 255 characters are not allowed');
        }
CVE-2019-18656 (JavaScript, published 2019-10-31T17:15Z)
Description: value: Pimcore 6.2.3 has XSS in the translations grid because bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js mishandles certain HTML elements.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js
Commit message: Fixed possible XSS in the translations grid


Vulnerable code:

Fixed code:
                renderer: function (text) {
                    return replace_html_event_attributes(strip_tags(text, 'div,span,b,strong,em,i,small,sup,sub,p'));
                },
CVE-2019-18981 (PHP, published 2019-11-15T05:15Z)
Description: value: Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-838 \u2014 Inappropriate Encoding for Output Context
The product uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component.
Repository: https://github.com/pimcore/pimcore
Files changed:
models/Notification/Service/NotificationService.php
Commit message: Notifications: do additional checks


Vulnerable code:

Fixed code:
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
        if($notification->getRecipient()->getId() != $recipientId) {
            throw new AccessDeniedHttpException();
        }
CVE-2019-18981 (PHP, published 2019-11-15T05:15Z)
Description: value: Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pimcore/pimcore
Files changed:
models/Notification/Service/NotificationService.php
Commit message: Notifications: do additional checks


Vulnerable code:

Fixed code:
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
        if($notification->getRecipient()->getId() != $recipientId) {
            throw new AccessDeniedHttpException();
        }
CVE-2019-18982 (PHP, published 2019-11-15T05:15Z)
Description: value: bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/EmailController.php
Commit message: [Email] Email log: do not allow script/iframe execution in preview window


Vulnerable code:
            return new Response($emailLog->getHtmlLog());

Fixed code:
            return new Response($emailLog->getHtmlLog(), 200, [
                'Content-Security-Policy' => "default-src 'self'; style-src 'self' 'unsafe-inline'"
            ]);
CVE-2019-18985 (PHP, published 2019-11-15T05:15Z)
Description: value: Pimcore before 6.2.2 lacks brute force protection for the 2FA token.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-307 \u2014 Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/LoginController.php
bundles/AdminBundle/Controller/Admin/UserController.php
Commit message: Brute-force attack protection for 2fa codes


Vulnerable code:
     *
     * @param Request $request
     *
    public function twoFactorAuthenticationAction(Request $request)
        $this->checkCsrfToken($request);


Fixed code:
    public function twoFactorAuthenticationAction(Request $request, BruteforceProtectionHandler $bruteforceProtectionHandler)

            // we have to call the check here manually, because BruteforceProtectionListener uses the 'username' from the request
            $bruteforceProtectionHandler->checkProtection($this->getAdminUser()->getName(), $request);


                $bruteforceProtectionHandler->addEntry($this->getAdminUser()->getName(), $request);
CVE-2019-18986 (PHP, published 2019-11-15T05:15Z)
Description: value: Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-307 \u2014 Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/LoginController.php
bundles/AdminBundle/Resources/views/Admin/Login/lostpassword.html.php
bundles/CoreBundle/Resources/translations/en.json
Commit message: Lost password service: do not expose info whether a user exists or not (avoid brute-force attacks)


Vulnerable code:
        $view->success = false;
        // TODO is the error on the view used somewhere?
                    $view->error = 'user inactive';
                    $view->error = 'user has no email address';
                    $view->error = 'user has no password';
                $view->error = 'user unknown';
            if (!$view->error) {

                    $view->success = true;
                    $view->error = 'could not send email';
            if ($view->error) {
<?php if ($this->success) { ?>
    <div class="text info">
    <?php if ($this->error) { ?>
        <div class="text error">
            <?= $this->translate('lostpassword_reset_error'); ?>
        </div>
    <?php } else { ?>
        <div class="text info">
            <?= $this->translate("Enter your username and pimcore will send a login link to your email address"); ?>
        </div>
    <?php } ?>

  "lostpassword_reset_error": "There was an error while sending the lost password info. Please try again or contact your administrator.",

Fixed code:
use Pimcore\Logger;
        $error = null;
                    $error = 'user inactive';
                    $error = 'user has no email address';
                    $error = 'user has no password';
                $error = 'user unknown';
            if (!$error) {
                    $error = 'could not send email';
            if ($error) {
                Logger::error('Lost password service: ' . $error);
<?php if ($this->getRequest()->getMethod() === 'POST') { ?>
    <div class="text error">
    <div class="text info">
        <?= $this->translate("Enter your username and pimcore will send a login link to your email address"); ?>
    </div>
CVE-2021-23340 (PHP, published 2021-02-18T15:15Z)
Description: value: This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename]. Since exportFile variable is not sanitized, an attacker can exploit a local file inclusion vulnerability.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Reports/CustomReportController.php
Commit message: Fixed LFI in custom report csv download


Vulnerable code:
            'exportFile' => $exportFile,

Fixed code:
            'exportFile' => basename($exportFile),
            $exportFile = PIMCORE_SYSTEM_TEMP_DIRECTORY . '/' . basename($exportFile);
CVE-2021-4081 (JavaScript, published 2021-12-10T11:15Z)
Description: value: pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Resources/public/js/pimcore/element/selector/asset.js
bundles/AdminBundle/Resources/public/js/pimcore/element/selector/document.js
bundles/AdminBundle/Resources/public/js/pimcore/element/selector/object.js
Commit message: [Admin UI] Escape query on Search Window


Vulnerable code:
        var formValues = this.formPanel.getForm().getFieldValues();
        var proxy = this.store.getProxy();
        proxy.setExtraParam("query", formValues.query);
        this.updateTabTitle(formValues.query);
        var formValues = this.formPanel.getForm().getFieldValues();
        var proxy = this.store.getProxy();
        proxy.setExtraParam("query", formValues.query);
        this.updateTabTitle(formValues.query);
        var formValues = this.formPanel.getForm().getFieldValues();

        var proxy = this.store.getProxy();
        proxy.setExtraParam("query", formValues.query);
        this.updateTabTitle(formValues.query);

Fixed code:
        let formValues = this.formPanel.getForm().getFieldValues();
        let proxy = this.store.getProxy();
        let query = Ext.util.Format.htmlEncode(formValues.query);
        proxy.setExtraParam("query", query);
        this.updateTabTitle(query);
        let formValues = this.formPanel.getForm().getFieldValues();
        let proxy = this.store.getProxy();
        let query = Ext.util.Format.htmlEncode(formValues.query);
        proxy.setExtraParam("query", query);
        this.updateTabTitle(query);
        let formValues = this.formPanel.getForm().getFieldValues();
        let proxy = this.store.getProxy();
        let query = Ext.util.Format.htmlEncode(formValues.query);
        proxy.setExtraParam("query", query);
        this.updateTabTitle(query);
CVE-2021-4082 (Other, published 2021-12-10T11:15Z)
Description: value: pimcore is vulnerable to Cross-Site Request Forgery (CSRF)
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/LoginController.php
bundles/AdminBundle/Resources/views/Admin/Index/index.html.twig
bundles/AdminBundle/Resources/views/Admin/Login/twoFactorAuthentication.html.twig
Commit message: [Admin] Logout action should use POST method


Vulnerable code:
     * @Route("/logout", name="pimcore_admin_logout")
    <a id="pimcore_logout" data-menu-tooltip="{{ "logout"|trans([],'admin') }}" href="{{ path('pimcore_admin_logout') }}" style="display: none">
        <img src="/bundles/pimcoreadmin/img/material-icons/outline-logout-24px.svg">
    </a>
    <a href="{{ path('pimcore_admin_logout') }}">{{ 'Back to Login'|trans([],'admin') }}</a>

Fixed code:
     * @Route("/logout", name="pimcore_admin_logout" , methods={"POST"})

    <form id="pimcore_logout_form" method="post" action="{{ path('pimcore_admin_logout') }}">
        <input type="hidden" name="csrfToken" value="{{ pimcore_csrf.getCsrfToken() }}">

        <a id="pimcore_logout" data-menu-tooltip="{{ "logout"|trans([],'admin') }}"
           href="#" onclick="document.getElementById('pimcore_logout_form').submit();" style="display: none">
            <img src="/bundles/pimcoreadmin/img/material-icons/outline-logout-24px.svg">
        </a>
    </form>
    <form id="pimcore_logout_form" method="post" action="{{ path('pimcore_admin_logout') }}">
        <input type="hidden" name="csrfToken" value="{{ pimcore_csrf.getCsrfToken() }}">
        <a href="#" onclick="document.getElementById('pimcore_logout_form').submit();">{{ 'Back to Login'|trans([],'admin') }}</a>
    </form>
CVE-2021-4084 (JavaScript, published 2021-12-10T12:15Z)
Description: value: pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Resources/public/js/pimcore/object/classes/class.js
Commit message: [Admin UI] DataObject Class - escape general settings input values (#10991)

* [Admin UI] DataObject Class - escape general settings input values

* Update bundles/AdminBundle/Resources/public/js/pimcore/object/classes/class.js

* [Admin UI] DataObject Class - escape general settings input values

* [Admin UI] DataObject Class - escape general settings input values

Vulnerable code:
                        this.data[item.name] = item.getValue();

Fixed code:
                        let value = item.getValue();
                        if (typeof item.config.xtype !== 'undefined' && item.config.xtype === 'textfield') {
                            value = Ext.util.Format.htmlEncode(value);
                        }

                        this.data[item.name] = value;
            renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
CVE-2022-0251 (PHP, published 2022-01-26T11:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.10.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
models/DataObject/ClassDefinition/Service.php
Commit message: disallow html entity names on import - follow up to #11217


Vulnerable code:
                $sanitizedName = htmlentities($name);
                if ($sanitizedName !== $name) {

Fixed code:
                if (preg_match('/<.+?>/', $name)) {
CVE-2022-0263 (PHP, published 2022-01-18T16:15Z)
Description: value: Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/SettingsController.php
Commit message: [Settings] Validate SVG uploads for branding


Vulnerable code:

Fixed code:
        if($fileExt === 'svg') {
            if(strpos(file_get_contents($_FILES['Filedata']['tmp_name']), '<script')) {
                throw new \Exception('Scripts in SVG files are not supported');
            }
        }