GHSA-54hw-mhgh-x4vc CVE-2021-4146
Business Logic Errors in pimcore
Medium
Packagist
- Severity
- 4.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.80%
- Chance of exploitation in the next 30 days. Higher than 56.59% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
10.2.9- Upgrade pimcore/pimcore to this version or later
Description
In pimcore versions prior to 10.2.9 discounts could be negative resulting in unintended behavior.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| pimcore/pimcore | < 10.2.9 |
10.2.9 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
pimcore/pimcore Packagist → 10.2.9
- composer
composer require pimcore/pimcore:^10.2.9
Severity breakdown
CVSS 3.1 4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-23rh-xw42-fq82 Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration | High | Also affects pimcore/pimcore |
| GHSA-9x44-4gxf-8c25 Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name | Critical | Also affects pimcore/pimcore |
| GHSA-w23p-wrp7-ch38 Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502) | Critical | Also affects pimcore/pimcore |
| GHSA-2mhj-fhvg-v428 Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name | High | Also affects pimcore/pimcore |
| GHSA-7p36-fq2r-4h7r Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed | High | Also affects pimcore/pimcore |
| GHSA-jwcc-gv4m-93x6 Pimcore has a CustomReports Share Bypass | High | Also affects pimcore/pimcore |
| GHSA-332x-r494-54fq Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export | Medium | Also affects pimcore/pimcore |
| GHSA-wc7j-g8wx-m2qx Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling | High | Also affects pimcore/pimcore |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor