Vulnerability Report

CVE-2024-29197

Title: Pimcore Information Disclosure

Information Disclosure

Proof Of Concept

No public PoC currently indexed for CVE-2024-29197.

CWE Category CWE-200
Published Date Mar 26, 2024
Modified Date Nov 05, 2025
Exploit Status Not Found
Score 6.5 CVSS v3.1
Exploit Probability (EPSS)
0.00%

Vulnerability Summary

CVE-2024-29197: Pimcore is an Open Source Data & Experience Management Platform. Any call with the query argument `?pimcore_preview=true` allows to view unpublished sites. In previous versions of Pimcore, session information would propagate to previews, so only a logged in user could open a preview. This no longer applies. Previews are broad open to any user and with just the hint of a restricted link one could gain access to possible confident / unreleased information. This vulnerability is fixed in 11.2.2 and 11.1.6.1.

Impacted Vendors

P
pimcore 1

Reference Links

https://github.com/pimcore/pimcore/commit/3ae43fb1065f9eb62ad2f542b883858d36d57e53 https://github.com/pimcore/pimcore/security/advisories/GHSA-5737-rqv4-v445 https://github.com/pimcore/pimcore/commit/3ae43fb1065f9eb62ad2f542b883858d36d57e53 https://github.com/pimcore/pimcore/security/advisories/GHSA-5737-rqv4-v445
CVSS v3.1
Source Entity [email protected]
Severity MEDIUM
6.5
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
REQUIRED
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2024-29197 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK
Complexity LOW
Privileges N/A
Interaction REQUIRED
CVSS Vector String CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected Stack

No specific products linked.