CVE-2024-24822: 
PHP vulnerability analysis and mitigation

CVE-2024-24822 affects Pimcore's Admin Classic Bundle, a backend user interface for Pimcore. The vulnerability was discovered and disclosed on February 7, 2024, affecting versions prior to 1.3.3. The issue allows attackers to perform unauthorized tag operations in the admin panel without having the required permissions (Vendor Advisory).

The vulnerability is classified as a Missing Authorization issue (CWE-862) with a CVSS v3.1 base score of 6.5 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) according to GitHub's assessment, while NVD rates it as 9.1 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). The vulnerability stems from a lack of permission checks in the tag management functionality, allowing unauthorized users to create, delete, and modify tags (Vendor Advisory).

The vulnerability enables attackers to perform broken access control and add tags to the admin panel with arbitrary data. This affects both the integrity and availability of the system by allowing unauthorized manipulation of tag data (Vendor Advisory).

The vulnerability has been fixed in version 1.3.3 of the Admin Classic Bundle. Users are advised to upgrade to this version. As a temporary workaround, the security patch can be applied manually by implementing the changes from pull request #412 (Patch, Vendor Advisory).