Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2021-39189

Description

Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patch manually.

POC

Reference

- https://huntr.dev/bounties/12462a99-ebf8-4e39-80b3-54a16caa3f4c/

Github

No PoCs found on GitHub currently.