CVE-2024-21665: Pimcore E-Commerce Framework

Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days.

ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Access control and permissions are not being enforced. This vulnerability has been patched in version 1.0.10.

Affected products

• Pimcore E-Commerce Framework: before 1.0.10 (fixed in 1.0.10)

Published 2024-01-11. Last modified 2026-06-17.