What is GHSA-mq3x-qgwx-3rfw?

GHSA-mq3x-qgwx-3rfw is a security advisory published by GitHub Security Advisories with High severity. Embedding untrusted input inside CSV files leads to Formula Injection/CSV Injection

Which CVE IDs does GHSA-mq3x-qgwx-3rfw cover?

GHSA-mq3x-qgwx-3rfw covers the following CVE IDs: CVE-2023-2629. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mq3x-qgwx-3rfw?

GHSA-mq3x-qgwx-3rfw has a CVSS v3 base score of 7.8, published by GitHub Security Advisories.

Which products are affected by GHSA-mq3x-qgwx-3rfw?

GHSA-mq3x-qgwx-3rfw affects 1 product, including: composer/pimcore/customer-management-framework-bundle:\u003c 3.3.9.

GHSA-mq3x-qgwx-3rfwHighCVSS 7.8

Embedding untrusted input inside CSV files leads to Formula Injection/CSV Injection

Vendor

GitHub Security Advisories

Published

May 11, 2023

Last Modified

November 7, 2023

🔗 CVE IDs covered (1)

CVE-2023-2629 →

📋 Description

Impact

The pimcore application is vulnerable to Formula Injection/CSV Injection via the Firstname, Lastname, Street, Zip & City input fields. These vulnerabilities allow unauthenticated attackers to execute arbitrary code via a crafted excel file.

Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data.

Patches

Update to version 3.3.9 or apply this patch manually https://github.com/pimcore/customer-data-framework/commit/4e0105c3a78d20686a0c010faef27d2297b98803.patch

Workarounds

Apply patch https://github.com/pimcore/customer-data-framework/commit/4e0105c3a78d20686a0c010faef27d2297b98803.patch manually.

References

https://huntr.dev/bounties/821ff465-4754-42d1-9376-813c17f16a01/

🎯 Affected products1

composer/pimcore/customer-management-framework-bundle:< 3.3.9