CVE-2021-37702

Опубликовано: 18 авг. 2021

Источник: nvd

CVSS3: 8

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

Pimcore is an open source data & experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The problem is patched in 10.1.1. Aside from upgrading, one may apply the patch manually as a workaround.

Ссылки

https://github.com/pimcore/pimcore/pull/9992
Patch
Third Party Advisory
https://github.com/pimcore/pimcore/security/advisories/GHSA-pp2h-95hm-hv9r
Patch
Third Party Advisory
https://github.com/pimcore/pimcore/pull/9992
Patch
Third Party Advisory
https://github.com/pimcore/pimcore/security/advisories/GHSA-pp2h-95hm-hv9r
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*

Версия до 10.1.1 (исключая)

EPSS

Процентиль: 10%

0.00036

Низкий

8 High

CVSS3

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-1236

Связанные уязвимости

GHSA-pp2h-95hm-hv9r

github

больше 4 лет назад

Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore

EPSS

Процентиль: 10%

0.00036

Низкий

8 High

CVSS3

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-1236