CVE-2023-28108

Name: CVE-2023-28108
Creator: NVD / NIST
Published: 2023-03-16T17:15:09.663+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.8/10EPSS 0.85%

Last modified Jun 17, 2026

CVE-2023-28108 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model. EPSS estimates a 0.85% chance of exploitation in the next 30 days.

Description

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model. There is the theoretical possibility to inject custom SQL if the developer is using this methods with input data and not doing proper input validation in advance and so relies on the auto-quoting being done by the DAO class. Users should update to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually.

Metrics

CVSS 3.1

7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.85%

53.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-89

Affected Software

Vendor	Product	Versions
Pimcore	Pimcore	< 10.5.19

References

https://github.com/pimcore/pimcore/commit/08e7ba56ae983c3c67ec563b6989b16ef8f35275.patchMailing List, Patch
https://github.com/pimcore/pimcore/pull/14633Patch
https://github.com/pimcore/pimcore/security/advisories/GHSA-xc9p-r5qj-8xm9Patch, Vendor Advisory
https://github.com/pimcore/pimcore/commit/08e7ba56ae983c3c67ec563b6989b16ef8f35275.patchMailing List, Patch
https://github.com/pimcore/pimcore/pull/14633Patch
https://github.com/pimcore/pimcore/security/advisories/GHSA-xc9p-r5qj-8xm9Patch, Vendor Advisory

Timeline

Published: Mar 16, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-28108?

How severe is CVE-2023-28108?

CVE-2023-28108 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.85% probability of exploitation in the next 30 days.

How do I fix CVE-2023-28108?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-28108?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST