CVE-2024-11956
Published: 28 January 2025
Summary
CVE-2024-11956 is a medium-severity Injection (CWE-74) vulnerability in Pimcore Pimcore. Its CVSS base score is 5.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 0.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-11956 is a SQL injection vulnerability (classified as critical, associated with CWE-74 and CWE-89) in Pimcore customer-data-framework versions up to 4.2.0. The issue affects unknown functionality in the file /admin/customermanagementframework/customers/list, where manipulation of the filterDefinition/filter argument triggers the injection.
The vulnerability is exploitable remotely over the network (AV:N) with low attack complexity (AC:L), but requires high privileges (PR:H) and no user interaction (UI:N). Attackers with sufficient access can achieve low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), corresponding to a CVSS v3.1 base score of 4.7 in an unchanged scope (S:U).
Advisories from Pimcore and VulDB recommend upgrading to version 4.2.1, which addresses the issue, as detailed in the GitHub release notes and security advisory (GHSA-q53r-9hh9-w277).
The exploit has been disclosed publicly and may be used, with the CVE published on 2025-01-28.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-0185
Vulnerability details
A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0. Affected by this issue is some unknown functionality of the file /admin/customermanagementframework/customers/list. The manipulation of the argument filterDefinition/filter leads to sql injection. The attack…
more
may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a remotely accessible web application endpoint directly enables exploitation of a public-facing app (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of untrusted inputs like the filterDefinition/filter argument to prevent SQL injection exploitation.
Mandates timely flaw remediation by applying the available patch to Pimcore customer-data-framework version 4.2.1.
Boundary protection with web application firewalls inspects and blocks remote requests containing SQL injection payloads in the filter parameter.