CVE-2019-18985

Pimcore before 6.2.2 lacks brute force protection for the 2FA token.

• CWE-307

• https://github.com/pimcore/pimcore/commit/9f2d075243a8392c114d9a8028858b9faf041e2dPatch, Third Party Advisory
• https://github.com/pimcore/pimcore/compare/v6.2.1...v6.2.2Patch, Third Party Advisory
• https://github.com/pimcore/pimcore/commit/9f2d075243a8392c114d9a8028858b9faf041e2dPatch, Third Party Advisory
• https://github.com/pimcore/pimcore/compare/v6.2.1...v6.2.2Patch, Third Party Advisory

Published

Nov 15, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18978An issue was discovered in the rack-cors (aka Rack CORS Midd…5.3
• CVE-2019-18979Adaware antivirus 12.6.1005.11662 and 12.7.1055.0 has a quar…7.8
• CVE-2019-1898A vulnerability in the web-based management interface of Cis…5.3
• CVE-2019-18980On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bu…7.5
• CVE-2019-18981Pimcore before 6.2.2 lacks an Access Denied outcome for a ce…9.8
• CVE-2019-18982bundles/AdminBundle/Controller/Admin/EmailController.php in …6.1
• CVE-2019-18986Pimcore before 6.2.2 allow attackers to brute-force (guess) …7.5
• CVE-2019-18987An issue was discovered in the AbuseFilter extension through…5.3
• CVE-2019-18988TeamViewer Desktop through 14.7.1965 allows a bypass of remo…7
• CVE-2019-18989A partial authentication bypass vulnerability exists on Medi…5.4
• CVE-2019-1899A vulnerability in the web interface of Cisco RV110W, RV130W…5.3
• CVE-2019-18990A partial authentication bypass vulnerability exists on Real…5.4