Pimcore vulnerable to disclosure of system and database information behind /admin firewall

diff --git a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php
--- a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php    (revision dd81ef4c666b18c254333867a60f6ed455025076)
+++ b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php    (date 1721225746781)
@@ -15,6 +15,7 @@

namespace Pimcore\Bundle\AdminBundle\Controller\Admin;

+use App\Constant\UserPermission;
use Doctrine\DBAL\Connection;
use Exception;
use Pimcore\Analytics\Google\Config\SiteConfigProvider;
@@ -142,6 +143,12 @@
throw $this->createAccessDeniedHttpException();
}

+        $user = $this->tokenResolver->getUser();
+
+        if (!$user->isAdmin() && !$user->isAllowed(UserPermission::ADMIN_INDEX_VIEW)) {
+            throw $this->createAccessDeniedException();
+        }
+
// DB
try {
$tables = $db->fetchAllAssociative('SELECT TABLE_NAME as name,TABLE_ROWS as `rows` from information_schema.TABLES

<?php

namespace App\EventListener\Admin;

use App\Constant\UserPermission;
use Pimcore\Bundle\AdminBundle\Event\AdminEvents;
use Pimcore\Event\Admin\IndexActionSettingsEvent;
use Pimcore\Security\User\TokenStorageUserResolver;
use Symfony\Component\EventDispatcher\EventSubscriberInterface;

/**
* @deprecated and cannot be used in Pimcore 11
*/
class PimcoreVersionUIGuardSubscriber implements EventSubscriberInterface
{
    public function __construct(private readonly TokenStorageUserResolver $tokenResolver)
    {
    }

    public static function getSubscribedEvents()
    {
        return [
            AdminEvents::INDEX_ACTION_SETTINGS => ['onIndexActionSettingsEvent'],
        ];
    }

    public function onIndexActionSettingsEvent(IndexActionSettingsEvent $event): void
    {
        $user = $this->tokenResolver->getUser();
        if ($user->isAdmin() || $user->isAllowed(UserPermission::ADMIN_INDEX_VIEW)) {
            return;
        }

        $settings = $event->getSettings();
        $settings['instanceId'] = '';
        $settings['version'] = '';
        $settings['build'] = '';
        $event->setSettings($settings);
    }
}