CVE-2023-49075

Publication date

2023-11-28 04:33:23

Family

GitHub_M

State

PUBLISHED

Description

The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundleSecurityPimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without having to provide the two factor credentials. This issue has been patched in version 1.2.2.