GHSA-cfcv-q4qq-2ph4

CKEditor 4 vulnerabilities in versions <4.16.1

Medium Packagist

Severity: Medium; The publisher's own rating, not a CVSS score
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 10.1.1; Upgrade pimcore/pimcore to this version or later

Description

Details see:

https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc ( CVE-2021-37695 ) https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6226-h7ff-ch6c ( CVE-2021-32808 ) https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7889-rm5j-hpgg ( CVE-2021-32809 )

Patch: https://github.com/pimcore/pimcore/pull/10032

Affected versions

Packagist

Package	Vulnerable	Fixed in
pimcore/pimcore	`< 10.1.1`	`10.1.1`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

pimcore/pimcore Packagist → `10.1.1`

composer

composer require pimcore/pimcore:^10.1.1

References

Packages

github.com/pimcore/pimcore

Timeline

Aug 23, 2021 Published
Dec 2, 2024 Last updated by the source

Advisory	Severity	Why it's related
GHSA-23rh-xw42-fq82 Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration	High	Also affects pimcore/pimcore
GHSA-9x44-4gxf-8c25 Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name	Critical	Also affects pimcore/pimcore
GHSA-w23p-wrp7-ch38 Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)	Critical	Also affects pimcore/pimcore
GHSA-2mhj-fhvg-v428 Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name	High	Also affects pimcore/pimcore
GHSA-7p36-fq2r-4h7r Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed	High	Also affects pimcore/pimcore
GHSA-jwcc-gv4m-93x6 Pimcore has a CustomReports Share Bypass	High	Also affects pimcore/pimcore
GHSA-332x-r494-54fq Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export	Medium	Also affects pimcore/pimcore
GHSA-wc7j-g8wx-m2qx Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling	High	Also affects pimcore/pimcore

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor