Vulnerability-Lookup

GHSA-PP2H-95HM-HV9R

Vulnerability from github – Published: 2021-08-30 16:13 – Updated: 2021-08-27 12:49

Summary

Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore

Details

Impact

Data Object CSV import allows formular injection.

Patches

Problem is patched in 10.1.1

Workarounds

Apply https://github.com/pimcore/pimcore/pull/9992.patch

References

https://cwe.mitre.org/data/definitions/1236.html

Show details on source website

JSON

To clipboard Create KEV Entry

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "pimcore/pimcore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-37702"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-26T20:12:56Z",
    "nvd_published_at": "2021-08-18T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nData Object CSV import allows formular injection. \n\n### Patches\nProblem is patched in 10.1.1\n\n### Workarounds\nApply https://github.com/pimcore/pimcore/pull/9992.patch\n\n### References\nhttps://cwe.mitre.org/data/definitions/1236.html\n",
  "id": "GHSA-pp2h-95hm-hv9r",
  "modified": "2021-08-27T12:49:12Z",
  "published": "2021-08-30T16:13:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-pp2h-95hm-hv9r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37702"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pimcore/pimcore/pull/9992"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pimcore/pimcore"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore"
}

CVE-2021-37702 (GCVE-0-2021-37702)

Vulnerability from cvelistv5 – Published: 2021-08-18 14:45 – Updated: 2024-08-04 01:23

Title

Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore

Summary

Pimcore is an open source data & experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The problem is patched in 10.1.1. Aside from upgrading, one may apply the patch manually as a workaround.

Severity ?

8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-1236 - Improper Neutralization of Formula Elements in a CSV File

Assigner

GitHub_M

References

URL

Tags

	https://github.com/pimcore/pimcore/security/advis…	x_refsource_CONFIRM
	https://github.com/pimcore/pimcore/pull/9992	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	pimcore	pimcore	Affected: < 10.1.1

Show details on NVD website

JSON

To clipboard Create KEV Entry

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:23:01.527Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-pp2h-95hm-hv9r"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/pimcore/pimcore/pull/9992"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pimcore",
          "vendor": "pimcore",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pimcore is an open source data \u0026 experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The problem is patched in 10.1.1. Aside from upgrading, one may apply the patch manually as a workaround."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1236",
              "description": "CWE-1236: Improper Neutralization of Formula Elements in a CSV File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-08-18T14:45:10",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-pp2h-95hm-hv9r"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pimcore/pimcore/pull/9992"
        }
      ],
      "source": {
        "advisory": "GHSA-pp2h-95hm-hv9r",
        "discovery": "UNKNOWN"
      },
      "title": "Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-37702",
          "STATE": "PUBLIC",
          "TITLE": "Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "pimcore",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 10.1.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "pimcore"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Pimcore is an open source data \u0026 experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The problem is patched in 10.1.1. Aside from upgrading, one may apply the patch manually as a workaround."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-1236: Improper Neutralization of Formula Elements in a CSV File"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/pimcore/pimcore/security/advisories/GHSA-pp2h-95hm-hv9r",
              "refsource": "CONFIRM",
              "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-pp2h-95hm-hv9r"
            },
            {
              "name": "https://github.com/pimcore/pimcore/pull/9992",
              "refsource": "MISC",
              "url": "https://github.com/pimcore/pimcore/pull/9992"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-pp2h-95hm-hv9r",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-37702",
    "datePublished": "2021-08-18T14:45:10",
    "dateReserved": "2021-07-29T00:00:00",
    "dateUpdated": "2024-08-04T01:23:01.527Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-PP2H-95HM-HV9R

Impact

Patches

Workarounds

References

CVE-2021-37702 (GCVE-0-2021-37702)

Tags

Sightings

Nomenclature