HighGHSA-hq76-662x-7mw4
Pimcore includes vulnerable PHPOffice/PhpSpreadsheet
Published 3 Sept 2024 · Updated 5 Dec 2024
Affected packages
pimcore/data-importerComposer
- Affected
- <1.8.9
- Fixed in
- 1.8.9
Update to the fixed version for your release line, for example:
composer require pimcore/data-importer:^1.8.9pimcore/data-importerComposer
- Affected
- >=1.9.0 <1.9.3
- Fixed in
- 1.9.3
Update to the fixed version for your release line, for example:
composer require pimcore/data-importer:^1.9.3pimcore/admin-ui-classic-bundleComposer
- Affected
- <1.3.11
- Fixed in
- 1.3.11
Update to the fixed version for your release line, for example:
composer require pimcore/admin-ui-classic-bundle:^1.3.11pimcore/admin-ui-classic-bundleComposer
- Affected
- >=1.4.0 <1.4.7
- Fixed in
- 1.4.7
Update to the fixed version for your release line, for example:
composer require pimcore/admin-ui-classic-bundle:^1.4.7pimcore/admin-ui-classic-bundleComposer
- Affected
- >=1.5.0 <1.5.4
- Fixed in
- 1.5.4
Update to the fixed version for your release line, for example:
composer require pimcore/admin-ui-classic-bundle:^1.5.4pimcore/pimcoreComposer
- Affected
- >=10.6.9.0 <10.6.9.12
- Fixed in
- 10.6.9.12
Update to the fixed version for your release line, for example:
composer require pimcore/pimcore:^10.6.9.12pimcore/pimcoreComposer
- Affected
- >=11.1.0.0 <11.1.6.11
- Fixed in
- 11.1.6.11
Update to the fixed version for your release line, for example:
composer require pimcore/pimcore:^11.1.6.11Details
Summary
Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: GHSA-ghg6-32f9-2jp7.
Is GHSA-hq76-662x-7mw4 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected pimcore/data-importer, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.