Skip to content
Fencer Intel
high 8.8

CVE-2019-10867 in the critical feed json

Pimcore Unserialize Remote Code Execution

published 7y ago modified last mo. also GHSA-7hqr-j26m-gmwp , EUVD-2022-3014

cvss
8.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
68.9%
EPSS 68.9% chance of exploitation in 30 days, percentile 99.3%
public exploits
2
Metasploit and Exploit-DB

Summary

An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.

Patch / fix

  • packagist pimcore/pimcore 5.7.1
  • pimcore pimcore 5.7.1

Is CVE-2019-10867 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

  1. First public exploit (Metasploit exploit/multi/http/pimcore_unserialize_rce)
  2. Published

Exploit prediction

68.87% chance of exploitation in the next 30 days, higher than 99.3% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/multi/http/pimcore_unserialize_rce Pimcore Unserialize RCE metasploit exploit, normal rank, 2019-03-11
  • EDB-46783 Pimcore < 5.71 - Unserialize Remote Code Execution (Metasploit) remote, 2019-04-30
  • snyk.io https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-173998 referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/152667/Pimcore-Unserialize-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P
GitHub 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
packagist pimcore/pimcore
<5.7.1
5.7.1

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.