{"id":"CVE-2017-1000009","details":"Akeneo PIM CE and EE \u003c1.6.6, \u003c1.5.15, \u003c1.4.28 are vulnerable to shell injection in the mass edition, resulting in remote execution.","aliases":["GHSA-q8cr-xphm-7gfv"],"modified":"2026-07-08T10:55:30.968490Z","published":"2017-07-17T13:18:16.187Z","references":[{"type":"FIX","url":"https://github.com/akeneo/pim-community-dev/blob/1.5/CHANGELOG-1.5.md#bug-fixes-2"},{"type":"FIX","url":"https://github.com/akeneo/pim-community-dev/blob/master/CHANGELOG-1.4.md#bug-fixes"},{"type":"FIX","url":"https://github.com/akeneo/pim-community-dev/blob/master/CHANGELOG-1.6.md#bug-fixes-2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/akeneo/pim-community-dev","events":[{"introduced":"f052fd7dda938fc4b31e4f66c4c9018d6d8c0abd"},{"last_affected":"eee6abd77fd5615c05bdde4f45902f53f0d9a9bc"}],"database_specific":{"cpe":["cpe:2.3:a:akeneo:product_information_management:1.4.0:-:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.0:-:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.0:beta1:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.0:beta1:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.0:beta2:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.0:beta2:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.0:beta3:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.0:beta3:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.0:rc1:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.0:rc1:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.1:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.1:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.2:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.2:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.3:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.3:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.4:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.4:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.5:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.5:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.6:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.6:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.7:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.7:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.8:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.8:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.9:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.9:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.10:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.10:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.11:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.11:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.12:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.12:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.13:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.13:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.14:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.14:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.15:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.15:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.16:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.16:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.17:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.17:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.18:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.18:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.19:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.19:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.20:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.20:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.21:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.21:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.22:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.22:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.23:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.23:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.24:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.24:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.25:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.25:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.26:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.26:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.27:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.4.27:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.0:-:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.0:-:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.0:alpha1:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.0:alpha1:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.0:beta1:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.0:beta1:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.0:rc1:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.0:rc1:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.1:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.1:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.2:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.2:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.3:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.3:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.4:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.4:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.5:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.5:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.6:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.6:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.7:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.7:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.8:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.8:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.9:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.9:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.10:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.10:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.11:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.11:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.12:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.12:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.13:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.13:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.14:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.5.14:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.6.0:-:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.6.0:-:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.6.0:alpha1:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.6.0:alpha1:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.6.0:alpha2:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.6.0:alpha2:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.6.0:rc1:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.6.0:rc1:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.6.1:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.6.1:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.6.2:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.6.2:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.6.3:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.6.3:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.6.4:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.6.4:*:*:*:community:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.6.5:*:*:*:enterprise:*:*:*","cpe:2.3:a:akeneo:product_information_management:1.6.5:*:*:*:community:*:*:*"],"extracted_events":[{"introduced":"1.4.0-NA"},{"last_affected":"1.4.0-NA"},{"introduced":"1.4.0-beta1"},{"last_affected":"1.4.0-beta1"},{"introduced":"1.4.0-beta2"},{"last_affected":"1.4.0-beta2"},{"introduced":"1.4.0-beta3"},{"last_affected":"1.4.0-beta3"},{"introduced":"1.4.0-rc1"},{"last_affected":"1.4.0-rc1"},{"introduced":"1.4.1"},{"last_affected":"1.4.1"},{"introduced":"1.4.2"},{"last_affected":"1.4.2"},{"introduced":"1.4.3"},{"last_affected":"1.4.3"},{"introduced":"1.4.4"},{"last_affected":"1.4.4"},{"introduced":"1.4.5"},{"last_affected":"1.4.5"},{"introduced":"1.4.6"},{"last_affected":"1.4.6"},{"introduced":"1.4.7"},{"last_affected":"1.4.7"},{"introduced":"1.4.8"},{"last_affected":"1.4.8"},{"introduced":"1.4.9"},{"last_affected":"1.4.9"},{"introduced":"1.4.10"},{"last_affected":"1.4.10"},{"introduced":"1.4.11"},{"last_affected":"1.4.11"},{"introduced":"1.4.12"},{"last_affected":"1.4.12"},{"introduced":"1.4.13"},{"last_affected":"1.4.13"},{"introduced":"1.4.14"},{"last_affected":"1.4.14"},{"introduced":"1.4.15"},{"last_affected":"1.4.15"},{"introduced":"1.4.16"},{"last_affected":"1.4.16"},{"introduced":"1.4.17"},{"last_affected":"1.4.17"},{"introduced":"1.4.18"},{"last_affected":"1.4.18"},{"introduced":"1.4.19"},{"last_affected":"1.4.19"},{"introduced":"1.4.20"},{"last_affected":"1.4.20"},{"introduced":"1.4.21"},{"last_affected":"1.4.21"},{"introduced":"1.4.22"},{"last_affected":"1.4.22"},{"introduced":"1.4.23"},{"last_affected":"1.4.23"},{"introduced":"1.4.24"},{"last_affected":"1.4.24"},{"introduced":"1.4.25"},{"last_affected":"1.4.25"},{"introduced":"1.4.26"},{"last_affected":"1.4.26"},{"introduced":"1.4.27"},{"last_affected":"1.4.27"},{"introduced":"1.5.0-NA"},{"last_affected":"1.5.0-NA"},{"introduced":"1.5.0-alpha1"},{"last_affected":"1.5.0-alpha1"},{"introduced":"1.5.0-beta1"},{"last_affected":"1.5.0-beta1"},{"introduced":"1.5.0-rc1"},{"last_affected":"1.5.0-rc1"},{"introduced":"1.5.1"},{"last_affected":"1.5.1"},{"introduced":"1.5.2"},{"last_affected":"1.5.2"},{"introduced":"1.5.3"},{"last_affected":"1.5.3"},{"introduced":"1.5.4"},{"last_affected":"1.5.4"},{"introduced":"1.5.5"},{"last_affected":"1.5.5"},{"introduced":"1.5.6"},{"last_affected":"1.5.6"},{"introduced":"1.5.7"},{"last_affected":"1.5.7"},{"introduced":"1.5.8"},{"last_affected":"1.5.8"},{"introduced":"1.5.9"},{"last_affected":"1.5.9"},{"introduced":"1.5.10"},{"last_affected":"1.5.10"},{"introduced":"1.5.11"},{"last_affected":"1.5.11"},{"introduced":"1.5.12"},{"last_affected":"1.5.12"},{"introduced":"1.5.13"},{"last_affected":"1.5.13"},{"introduced":"1.5.14"},{"last_affected":"1.5.14"},{"introduced":"1.6.0-NA"},{"last_affected":"1.6.0-NA"},{"introduced":"1.6.0-alpha1"},{"last_affected":"1.6.0-alpha1"},{"introduced":"1.6.0-alpha2"},{"last_affected":"1.6.0-alpha2"},{"introduced":"1.6.0-rc1"},{"last_affected":"1.6.0-rc1"},{"introduced":"1.6.1"},{"last_affected":"1.6.1"},{"introduced":"1.6.2"},{"last_affected":"1.6.2"},{"introduced":"1.6.3"},{"last_affected":"1.6.3"},{"introduced":"1.6.4"},{"last_affected":"1.6.4"},{"introduced":"1.6.5"},{"last_affected":"1.6.5"}],"source":"CPE_STRING"}}],"versions":["1.4.0-NA","1.4.0-beta1","1.4.0-beta2","1.4.0-beta3","1.4.0-rc1","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.19","1.4.2","1.4.20","1.4.21","1.4.22","1.4.23","1.4.24","1.4.25","1.4.26","1.4.27","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5.0-NA","1.5.0-alpha1","1.5.0-beta1","1.5.0-rc1","1.5.1","1.5.10","1.5.11","1.5.12","1.5.13","1.5.14","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6.0-NA","1.6.0-alpha1","1.6.0-alpha2","1.6.0-rc1","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-1000009.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}