CVE-2024-25625
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential security vulnerability has been discovered in `pimcore/admin-ui-classic-bundle` prior to version 1.3.4. The vulnerabili...
Affects 1 product across 1 vendor.
Parent class for all injection vulnerabilities where attacker-supplied data is interpreted as code or commands.
Show all 37
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A Host Header Injection vulnerability exists in Pimcore's Admin Classic Bundle prior to version 1.3.4, which could allow attackers to manipulate the host header to redirect users to malicious sites.
BSID: BS-2024-GLOBAL-051987-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2024-25625?
What is the CVSS score for CVE-2024-25625?
Is CVE-2024-25625 actively exploited?
How do I remediate CVE-2024-25625?
What systems are affected by CVE-2024-25625?
| CVE ID | CVE-2024-25625 |
|---|---|
| BSID | BS-2024-GLOBAL-051987-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N |
| Published | 2024-02-19 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 0% |
| Weakness (CWE) | |
| Source | NVD |
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential security vulnerability has been discovered in `pimcore/admin-ui-classic-bundle` prior to version 1.3.4. The vulnerability involves a Host Header Injection in the `invitationLinkAction` function of the UserController, specifically in the way `$loginUrl` trusts user input. The host header from incoming HTTP requests is used unsafely when generating URLs. An attacker can manipulate the HTTP host header in requests to the /admin/user/invitationlink endpoint, resulting in the generation of URLs with the attacker's domain. In fact, if a host header is injected in the POST request, the $loginURL parameter is constructed with this unvalidated host header. It is then used to send an invitation email to the provided user. This vulnerability can be used to perform phishing attacks by making the URLs in the invitation links emails point to an attacker-controlled domain. Version 1.3.4 contains a patch for the vulnerability. The maintainers recommend validating the host header and ensuring it matches the application's domain. It would also be beneficial to use a default trusted host or hostname if the incoming host header is not recognized or is absent.
Source: NIST NVD / MITRE CVE Database
The vulnerability is located in the `invitationLinkAction` function of the UserController within the `pimcore/admin-ui-classic-bundle`. The `$loginUrl` variable does not properly validate the host header from incoming HTTP requests, making it susceptible to Host Header Injection attacks.
Exploitation Likelihood: HIGH
| Vendor | Product | Affected Versions |
|---|---|---|
| Pimcore | Admin Classic Bundle | < 1.3.4 |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 52c5d566f642e5246e0778c63fff06aa74c2954acec095bfd157e88677dd0347aca8aae555d227a801f4937805ce2f699f8b8bae4c85ffb0a546b61e1bfe42d2 |
Critical Severity - Know Your Exposure
A CVSS 9.3 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →