GHSA-hq76-662x-7mw4 Pimcore includes vulnerable PHPOffice/PhpSpreadsheet
Pimcore includes a vulnerable dependency, requiring an upgrade to mitigate potential security risks associated with the underlying library.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Not stated
- Victim action needed
- Not stated
- Fix
- Available
What is GHSA-hq76-662x-7mw4?
GHSA-hq76-662x-7mw4 is a vulnerability in pimcore/admin-ui-classic-bundle, published on 3 Sep 2024.
Official description
Summary
Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: GHSA-ghg6-32f9-2jp7.
Which versions are affected by GHSA-hq76-662x-7mw4?
14 open source packages ship an affected version, including pimcore/admin-ui-classic-bundle, pimcore/data-importer and pimcore/pimcore.
| Package | Affected | Fixed in |
|---|---|---|
pimcore/admin-ui-classic-bundle Packagist | All versions | 1.3.11 |
pimcore/admin-ui-classic-bundle Packagist | All versions | 1.3.11 |
pimcore/admin-ui-classic-bundle Packagist | From 1.4.0 | 1.4.7 |
pimcore/admin-ui-classic-bundle Packagist | From 1.4.0 | 1.4.7 |
pimcore/admin-ui-classic-bundle Packagist | From 1.5.0 | 1.5.4 |
pimcore/admin-ui-classic-bundle Packagist | From 1.5.0 | 1.5.4 |
8 more packages
pimcore/data-importer Packagist | All versions | 1.8.9 |
pimcore/data-importer Packagist | All versions | 1.8.9 |
pimcore/data-importer Packagist | From 1.9.0 | 1.9.3 |
pimcore/data-importer Packagist | From 1.9.0 | 1.9.3 |
pimcore/pimcore Packagist | From 10.6.9.0 | 10.6.9.12 |
pimcore/pimcore Packagist | From 10.6.9.0 | 10.6.9.12 |
pimcore/pimcore Packagist | From 11.1.0.0 | 11.1.6.11 |
pimcore/pimcore Packagist | From 11.1.0.0 | 11.1.6.11 |
How do I fix GHSA-hq76-662x-7mw4?
Upgrade pimcore/admin-ui-classic-bundle to a fixed version for your release line: 1.3.11, 1.4.7 or 1.5.4.
Is GHSA-hq76-662x-7mw4 being exploited?
There is no known exploitation of GHSA-hq76-662x-7mw4 in the wild and no public exploit code.