GitHub Advisoryadvisory · Packagist

GHSA-q8cr-xphm-7gfv Akeneo PIM vulnerable to shell injection in the mass edition

CRITICAL Published 2022-05-13 Modified 2024-04-25 Official page ↗
Aliases
CVE-2017-1000009
Ecosystem
Packagist
Packages
akeneo/pim-community-dev
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2024-04-25

Affected packages

• Packagist akeneo/pim-community-dev: >= 1.4, < 1.4.28 → fixed in 1.4.28 • Packagist akeneo/pim-community-dev: >= 1.5, < 1.5.15 → fixed in 1.5.15 • Packagist akeneo/pim-community-dev: >= 1.6, < 1.6.6 → fixed in 1.6.6

Description

Akeneo PIM CE and EE <1.6.6, <1.5.15, <1.4.28 are vulnerable to shell injection in the mass edition, resulting in remote execution.

Related

Alias · CVE (1)

  • CVE-2017-1000009 Akeneo PIM CE and EE <1.6.6, <1.5.15, <1.4.28 are vulnerable to shell injection in the mass edition, resulting in remote execution. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References