GHSA-hq76-662x-7mw4
Pimcore includes vulnerable PHPOffice/PhpSpreadsheet
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
- Available
- 3 packages have a fixed version
Description
Summary
Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: GHSA-ghg6-32f9-2jp7.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| pimcore/admin-ui-classic-bundle | < 1.3.11 |
1.3.11 |
| pimcore/admin-ui-classic-bundle | >= 1.4.0, < 1.4.7 |
1.4.7 |
| pimcore/admin-ui-classic-bundle | >= 1.5.0, < 1.5.4 |
1.5.4 |
| pimcore/data-importer | < 1.8.9 |
1.8.9 |
| pimcore/data-importer | >= 1.9.0, < 1.9.3 |
1.9.3 |
| pimcore/pimcore | >= 10.6.9.0, < 10.6.9.12 |
10.6.9.12 |
| pimcore/pimcore | >= 11.1.0.0, < 11.1.6.11 |
11.1.6.11 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
pimcore/admin-ui-classic-bundle Packagist → 1.3.11
- composer
composer require pimcore/admin-ui-classic-bundle:^1.3.11
pimcore/data-importer Packagist → 1.8.9
- composer
composer require pimcore/data-importer:^1.8.9
pimcore/pimcore Packagist → 10.6.9.12
- composer
composer require pimcore/pimcore:^10.6.9.12
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- Passive
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-23rh-xw42-fq82 Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration | High | Also affects pimcore/pimcore |
| GHSA-9x44-4gxf-8c25 Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name | Critical | Also affects pimcore/pimcore |
| GHSA-w23p-wrp7-ch38 Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502) | Critical | Also affects pimcore/pimcore |
| GHSA-2mhj-fhvg-v428 Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name | High | Also affects pimcore/pimcore |
| GHSA-7p36-fq2r-4h7r Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed | High | Also affects pimcore/pimcore |
| GHSA-jwcc-gv4m-93x6 Pimcore has a CustomReports Share Bypass | High | Also affects pimcore/pimcore |
| GHSA-332x-r494-54fq Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export | Medium | Also affects pimcore/pimcore |
| GHSA-wc7j-g8wx-m2qx Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling | High | Also affects pimcore/pimcore |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor