Skip to content
Fencer Intel
high 8.8

GHSA-hq76-662x-7mw4 json

Pimcore includes vulnerable PHPOffice/PhpSpreadsheet

published 2y ago modified last yr.

cvss
8.8
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Summary Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: [GHSA-ghg6-32f9-2jp7](https://github.com/advisories/GHSA-ghg6-32f9-2jp7).

Patch / fix

  • packagist pimcore/data-importer 1.8.9, 1.9.3
  • packagist pimcore/admin-ui-classic-bundle 1.3.11, 1.4.7, 1.5.4
  • packagist pimcore/pimcore 10.6.9.12, 11.1.6.11

Is GHSA-hq76-662x-7mw4 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by version score vector
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
packagist pimcore/data-importer
<1.8.9
>=1.9.0, <1.9.3
1.8.9
1.9.3
packagist pimcore/admin-ui-classic-bundle
<1.3.11
>=1.4.0, <1.4.7
>=1.5.0, <1.5.4
1.3.11
1.4.7
1.5.4
packagist pimcore/pimcore
>=10.6.9.0, <10.6.9.12
>=11.1.0.0, <11.1.6.11
10.6.9.12
11.1.6.11

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.