CVE-2023-49075 (published 2023-11-28T04:33:23.642Z)
The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without having to provide the two factor credentials. This issue has been patched in version 1.2.2.


Affected products: Vendor: pimcore
Product: admin-ui-classic-bundle
Versions: < 1.2.2