GHSA-pp2h-95hm-hv9r

ghsaUSosv

Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore

view advisory published 2021-08-30Licence: CC-BY-4.0

### Impact Data Object CSV import allows formular injection. ### Patches Problem is patched in 10.1.1 ### Workarounds Apply https://github.com/pimcore/pimcore/pull/9992.patch ### References https://cwe.mitre.org/data/definitions/1236.html

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-37702US	high8.8	1.06% (64th)	—	2021-08-18
Pimcore is an open source data & experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The problem is patched in 10.1.1. Aside…

references

External citations — patches, advisories, analysis.

https://github.com/pimcore/pimcorePACKAGE
https://github.com/pimcore/pimcore/pull/9992WEB
https://github.com/pimcore/pimcore/security/advisories/GHSA-pp2h-95hm-hv9rWEB
https://nvd.nist.gov/vuln/detail/CVE-2021-37702ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan