{"id":"CVE-2024-41109","url":"https://www.cyber-defence.io/tools/cve/CVE-2024-41109","generatedAt":"2026-10-28T07:26:03.614Z","title":"Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system.","description":"Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system.  This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.","published":"2024-07-30T15:15:13.000Z","lastModified":"2026-06-17T07:47:17.000Z","status":"Analyzed","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-200"],"affected":["pimcore/admin classic bundle"],"epss":{"score":0.00483,"percentile":0.41398,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.48%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40","tags":["Product"],"source":"security-advisories@github.com"},{"url":"https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0","tags":["Patch"],"source":"security-advisories@github.com"},{"url":"https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2","tags":["Release Notes"],"source":"security-advisories@github.com"},{"url":"https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36","tags":["Exploit","Vendor Advisory"],"source":"security-advisories@github.com"},{"url":"https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40","tags":["Product"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0","tags":["Patch"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2","tags":["Release Notes"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36","tags":["Exploit","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-41109","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}