{"id":"GHSA-hq76-662x-7mw4","summary":"Pimcore includes vulnerable PHPOffice/PhpSpreadsheet","details":"### Summary\nPimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: [GHSA-ghg6-32f9-2jp7](https://github.com/advisories/GHSA-ghg6-32f9-2jp7).\n\n","modified":"2024-12-05T05:28:51.120085Z","published":"2024-09-03T19:45:26Z","database_specific":{"github_reviewed_at":"2024-09-03T19:45:26Z","nvd_published_at":null,"cwe_ids":[],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-ghg6-32f9-2jp7"},{"type":"PACKAGE","url":"https://github.com/pimcore/pimcore"}],"affected":[{"package":{"name":"pimcore/data-importer","ecosystem":"Packagist","purl":"pkg:composer/pimcore/data-importer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.9"}]}],"versions":["v1.0","v1.0.1","v1.1","v1.1.1","v1.1.2","v1.1.3","v1.1.4","v1.1.5","v1.2.0","v1.2.1","v1.2.2","v1.3.0","v1.3.1","v1.3.2","v1.3.3","v1.3.4","v1.3.5","v1.3.6","v1.4.0","v1.4.1","v1.4.2","v1.4.3","v1.4.4","v1.4.5","v1.4.6","v1.5.0","v1.5.1","v1.6.0","v1.6.1","v1.6.2","v1.6.3","v1.6.4","v1.6.5","v1.7.0","v1.7.1","v1.7.2","v1.7.3","v1.7.4","v1.7.5","v1.8.0","v1.8.0-BETA1","v1.8.0-RC1","v1.8.1","v1.8.2","v1.8.3","v1.8.4","v1.8.5","v1.8.6","v1.8.7","v1.8.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-hq76-662x-7mw4/GHSA-hq76-662x-7mw4.json"}},{"package":{"name":"pimcore/data-importer","ecosystem":"Packagist","purl":"pkg:composer/pimcore/data-importer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0"},{"fixed":"1.9.3"}]}],"versions":["v1.9.0","v1.9.1","v1.9.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-hq76-662x-7mw4/GHSA-hq76-662x-7mw4.json"}},{"package":{"name":"pimcore/admin-ui-classic-bundle","ecosystem":"Packagist","purl":"pkg:composer/pimcore/admin-ui-classic-bundle"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.11"}]}],"versions":["v1.0.0","v1.0.0-BETA1","v1.0.0-RC1","v1.0.0-RC2","v1.0.1","v1.0.2","v1.0.3","v1.0.4","v1.0.5","v1.0.6","v1.1.0","v1.1.0-RC1","v1.1.1","v1.1.2","v1.1.3","v1.1.4","v1.2","v1.2.0-RC1","v1.2.1","v1.2.2","v1.2.3","v1.3.0","v1.3.0-RC1","v1.3.1","v1.3.2","v1.3.3","v1.3.4","v1.3.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-hq76-662x-7mw4/GHSA-hq76-662x-7mw4.json"}},{"package":{"name":"pimcore/admin-ui-classic-bundle","ecosystem":"Packagist","purl":"pkg:composer/pimcore/admin-ui-classic-bundle"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.7"}]}],"versions":["1.4.0","v1.4.1","v1.4.2","v1.4.3","v1.4.4","v1.4.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-hq76-662x-7mw4/GHSA-hq76-662x-7mw4.json"}},{"package":{"name":"pimcore/admin-ui-classic-bundle","ecosystem":"Packagist","purl":"pkg:composer/pimcore/admin-ui-classic-bundle"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.5.4"}]}],"versions":["v1.5.0","v1.5.1","v1.5.2","v1.5.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-hq76-662x-7mw4/GHSA-hq76-662x-7mw4.json"}},{"package":{"name":"pimcore/pimcore","ecosystem":"Packagist","purl":"pkg:composer/pimcore/pimcore"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.6.9.0"},{"fixed":"10.6.9.12"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-hq76-662x-7mw4/GHSA-hq76-662x-7mw4.json"}},{"package":{"name":"pimcore/pimcore","ecosystem":"Packagist","purl":"pkg:composer/pimcore/pimcore"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.1.0.0"},{"fixed":"11.1.6.11"}]}],"versions":["v11.1.1","v11.1.2","v11.1.3","v11.1.4","v11.1.5","v11.1.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-hq76-662x-7mw4/GHSA-hq76-662x-7mw4.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}