UpHeron
All vulnerabilities

Servers and applications

CVE-2023-28108

Improper quoting of columns when calling methods "getByUuid" & "exists" on UUID Model

Severity
High 7.8
Published
16 Mar 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
10.5.19
Also known as
GHSA-xc9p-r5qj-8xm9
Sources
NVD, Project advisories (GitHub)

Description

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model. There is the theoretical possibility to inject custom SQL if the developer is using this methods with input data and not doing proper input validation in advance and so relies on the auto-quoting being done by the DAO class. Users should update to version…

Affected software

SoftwareAffected versions
PimcoreServers and applications · cpe:a:pimcore:pimcore
  • Every version before 10.5.19
PimcoreServers and applications · github:pimcore/pimcore
  • Every version before 10.5.19

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-28108
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-28108
  • GitHub Advisory Database https://github.com/advisories/GHSA-xc9p-r5qj-8xm9
  • github.com https://github.com/pimcore/pimcore/security/advisories/GHSA-xc9p-r5qj-8xm9