Vulnerability DatabaseCVE-2019-10867
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2019-10867
Published:April 04, 2019
Updated:September 21, 2026
An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.
Affected Packages
pimcore/pimcore (PHP):
Affected version(s) >=dev-release_10-4 <v5.7.1
Fix Suggestion:
Update to version v5.7.1
Related Resources (8)
http://www.rapid7.com/db/modules/exploit/multi/http/pimcore_unserialize_rce
https://github.com/pimcore/pimcore/commit/38a29e2f4f5f060a73974626952501cee05fda73
https://github.com/pimcore/pimcore
https://nvd.nist.gov/vuln/detail/CVE-2019-10867
http://packetstormsecurity.com/files/152667/Pimcore-Unserialize-Remote-Code-Execution.html
https://www.exploit-db.com/exploits/46783/
https://www.exploit-db.com/exploits/46783
https://blog.certimetergroup.com/it/articolo/security/polyglot_phar_deserialization_to_rce
Do you need more information?
Contact Us
CVSS v4
Base Score:
8.7
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Deserialization of Untrusted Data
CWE-502
EPSS
Base Score:
64.56