Lucene search

GitHub Advisory DatabaseGHSA-HQ76-662X-7MW4

HistorySep 03, 2024 - 7:45 p.m.

Pimcore includes vulnerable PHPOffice/PhpSpreadsheet

2024-09-0319:45:26

GitHub Advisory Database

github.com

pimcore enterprise security

phpoffice/phpspreadsheet vulnerability

version 1.x

cve-2024-45048

version 2.2.2

ghsa-ghg6-32f9-2jp7

official advisory

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

Low

EPSS

0.001

Percentile

36.5%

JSON

Summary

Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: GHSA-ghg6-32f9-2jp7.

Affected configurations

Vulners

Node

pimcorepimcoreRange11.1.0.0–11.1.6.11

pimcorepimcoreRange10.6.9.0–10.6.9.12

pimcoreadmin_classic_bundleRange1.5.0–1.5.4pimcore

pimcoreadmin_classic_bundleRange1.4.0–1.4.7pimcore

pimcoreadmin_classic_bundleRange<1.3.11pimcore

pimcoredata-hubRange1.9.0–1.9.3

pimcoredata-hubRange<1.8.9

VendorProductVersionCPE
pimcorepimcore*cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*
pimcoreadmin_classic_bundle*cpe:2.3:a:pimcore:admin_classic_bundle:*:*:*:*:*:pimcore:*:*
pimcoredata-hub*cpe:2.3:a:pimcore:data-hub:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pimcore	pimcore	*	cpe:2.3:a:pimcore:pimcore::::::::
pimcore	admin_classic_bundle	*	cpe:2.3:a:pimcore:admin_classic_bundle::::::pimcore::*
pimcore	data-hub	*	cpe:2.3:a:pimcore:data-hub::::::::

References

github.com/advisories/GHSA-ghg6-32f9-2jp7

github.com/advisories/GHSA-hq76-662x-7mw4

github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

Low

EPSS

0.001

Percentile

36.5%

JSON

Related for GHSA-HQ76-662X-7MW4