CVE Vulnerabilities

CVE-2023-5192

Excessive Data Query Operations in a Large Data Table

Published: Sep 27, 2023 | Modified: Sep 29, 2023
CVSS 3.x
6.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

Excessive Data Query Operations in a Large Data Table in GitHub repository pimcore/demo prior to 10.3.0.

Weakness

The product performs a data query with a large number of joins and sub-queries on a large data table.

Affected Software

Name Vendor Start Version End Version
Core Pimcore * 10.3.0 (excluding)

Extended Description

This issue can make the product perform more slowly. If the relevant code is reachable by an attacker, then this performance problem might introduce a vulnerability. While the interpretation of “large data table” and “large number of joins or sub-queries” may vary for each product or developer, CISQ recommends a default of 1 million rows for a “large” data table, a default minimum of 5 joins, and a default minimum of 3 sub-queries.

References