CVE-2017-1000009 Akeneo PIM vulnerable to shell injection in the mass edition
Attackers can execute arbitrary shell commands via mass edition features in Akeneo PIM, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-1000009?
CVE-2017-1000009 is a critical command injection vulnerability in n/a, published on 13 Jul 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Akeneo PIM CE and EE <1.6.6, <1.5.15, <1.4.28 are vulnerable to shell injection in the mass edition, resulting in remote execution.
Weakness: CWE-78
Which versions are affected by CVE-2017-1000009?
6 open source packages ship an affected version, including akeneo/pim-community-dev. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
akeneo/pim-community-dev Packagist | From 1.4 | 1.4.28 |
akeneo/pim-community-dev Packagist | From 1.4 | 1.4.28 |
akeneo/pim-community-dev Packagist | From 1.5 | 1.5.15 |
akeneo/pim-community-dev Packagist | From 1.5 | 1.5.15 |
akeneo/pim-community-dev Packagist | From 1.6 | 1.6.6 |
akeneo/pim-community-dev Packagist | From 1.6 | 1.6.6 |
Products include Akeneo Product Information Management.
How do I fix CVE-2017-1000009?
Upgrade akeneo/pim-community-dev to a fixed version for your release line: 1.4.28, 1.5.15 or 1.6.6.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2017-1000009 being exploited?
There is no known exploitation of CVE-2017-1000009 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-q8cr-xphm-7gfv.