github - ghsa-2v7p-f4qm-r5pc

ghsa-2v7p-f4qm-r5pc

Vulnerability from github

Published

2022-04-23 00:03

Modified

2022-05-03 21:01

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

SQL Injection found in Pimcore

Details

Pimcore is an open source data & experience management platform. A SQL injection was discovered in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6.

Show details on source website

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "pimcore/pimcore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.3.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-1429"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-05-03T21:01:41Z",
    "nvd_published_at": "2022-04-22T09:15:00Z",
    "severity": "HIGH"
  },
  "details": "Pimcore is an open source data \u0026 experience management platform. A SQL injection was discovered in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6.",
  "id": "GHSA-2v7p-f4qm-r5pc",
  "modified": "2022-05-03T21:01:41Z",
  "published": "2022-04-23T00:03:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1429"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pimcore/pimcore/commit/523a735ab94f004459b84ffdfd3db784586bbd82"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pimcore/pimcore"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/cfba30b4-85fa-4499-9160-cd6e3119310e"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SQL Injection found in Pimcore"
}

CVE-2022-1429 (GCVE-0-2022-1429)

Vulnerability from cvelistv5

Published

2022-04-22 09:10

Modified

2024-08-03 00:03

Severity ?

7.2 (High) - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command

Summary

SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6. This vulnerability is capable of steal the data

References

►

URL

Tags

	https://huntr.dev/bounties/cfba30b4-85fa-4499-9160-cd6e3119310e	x_refsource_CONFIRM
	https://github.com/pimcore/pimcore/commit/523a735ab94f004459b84ffdfd3db784586bbd82	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	pimcore	pimcore/pimcore	Version: unspecified < 10.3.6

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:03:06.261Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/cfba30b4-85fa-4499-9160-cd6e3119310e"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/pimcore/pimcore/commit/523a735ab94f004459b84ffdfd3db784586bbd82"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pimcore/pimcore",
          "vendor": "pimcore",
          "versions": [
            {
              "lessThan": "10.3.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6. This vulnerability is capable of steal the data"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-22T09:10:09",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/cfba30b4-85fa-4499-9160-cd6e3119310e"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pimcore/pimcore/commit/523a735ab94f004459b84ffdfd3db784586bbd82"
        }
      ],
      "source": {
        "advisory": "cfba30b4-85fa-4499-9160-cd6e3119310e",
        "discovery": "EXTERNAL"
      },
      "title": "SQL injection in GridHelperService.php in pimcore/pimcore",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2022-1429",
          "STATE": "PUBLIC",
          "TITLE": "SQL injection in GridHelperService.php in pimcore/pimcore"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "pimcore/pimcore",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "10.3.6"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "pimcore"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6. This vulnerability is capable of steal the data"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/cfba30b4-85fa-4499-9160-cd6e3119310e",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/cfba30b4-85fa-4499-9160-cd6e3119310e"
            },
            {
              "name": "https://github.com/pimcore/pimcore/commit/523a735ab94f004459b84ffdfd3db784586bbd82",
              "refsource": "MISC",
              "url": "https://github.com/pimcore/pimcore/commit/523a735ab94f004459b84ffdfd3db784586bbd82"
            }
          ]
        },
        "source": {
          "advisory": "cfba30b4-85fa-4499-9160-cd6e3119310e",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2022-1429",
    "datePublished": "2022-04-22T09:10:10",
    "dateReserved": "2022-04-22T00:00:00",
    "dateUpdated": "2024-08-03T00:03:06.261Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.