CVE-2023-2756

Description

### Impact An administrator user can use the inheritable segments feature to execute his own blind SQL queries. A user with administrator privileges can run any SQL query on database. This can be used to retrieve sensitive data, change database information or any other malicious activity against the database. ### Patches Update to version 3.3.10 or apply this patch manually https://github.com/pimcore/customer-data-framework/commit/76df151737b7964ce5169fdf9e27a0ad801757fe.patch ### Workarounds Apply https://github.com/pimcore/customer-data-framework/commit/76df151737b7964ce5169fdf9e27a0ad801757fe.patch manually. ### References https://huntr.dev/bounties/cf398528-819f-456e-88e7-c06d268d3f44/

How to fix CVE-2023-2756

To remediate CVE-2023-2756, upgrade the affected package to a fixed version below.

• —upgrade to 3.3.10 or later

Is CVE-2023-2756 being exploited?

Low — EPSS is 0.9%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 3.3.10

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-2756
• PATCHgithub.com/pimcore/customer-data-framework
• WEBgithub.com/pimcore/customer-data-framework/commit/76df151737b7964ce5169fdf9e27a0ad801757fe
• WEBgithub.com/pimcore/customer-data-framework/security/advisories/GHSA-25fx-3c2q-cq46