CVE-2024-29197: Pimcore Preview Documents are not restricted to logged in users anymore

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-03-26 · updated 2026-06-17
Weakness: CWE-200

Description

Pimcore is an Open Source Data & Experience Management Platform. Any call with the query argument `?pimcore_preview=true` allows to view unpublished sites. In previous versions of Pimcore, session information would propagate to previews, so only a logged in user could open a preview. This no longer applies. Previews are broad open to any user and with just the hint of a restricted link one could gain access to possible confident / unreleased information. This vulnerability is fixed in 11.2.2 and 11.1.6.1.

Affected products

pimcore/pimcore: from 11.0.0 before 11.1.6.1; from 11.2.0 before 11.2.2 — fixed in 11.1.6.1, 11.2.2

How to fix

Upgrade to a fixed version: pimcore/pimcore 11.1.6.1, 11.2.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-29197 or the next vulnerability affects your stack