MediumGHSA-54hw-mhgh-x4vcCVE-2021-4146
Business Logic Errors in pimcore
Published 26 Jan 2022 · Updated 4 Dec 2024
Affected package
pimcore/pimcoreComposer
- Affected
- <10.2.9
- Fixed in
- 10.2.9
Update to the fixed version for your release line, for example:
composer require pimcore/pimcore:^10.2.9Details
In pimcore versions prior to 10.2.9 discounts could be negative resulting in unintended behavior.
Is GHSA-54hw-mhgh-x4vc in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected pimcore/pimcore, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2021-4146
- Linkgithub.com/pimcore/pimcore/issues/11024
- Linkgithub.com/pimcore/pimcore/pull/11206
- Linkgithub.com/pimcore/pimcore/commit/7011922f7f0f97a82d8c378559b91fcdb34604a6
- Packagegithub.com/pimcore/pimcore
- Linkhuntr.dev/bounties/47b37054-cafe-4f48-8b40-c86efc7fb760
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.