What is GHSA-q8cr-xphm-7gfv?

GHSA-q8cr-xphm-7gfv is a security advisory published by GitHub Security Advisories with Critical severity. Akeneo PIM vulnerable to shell injection in the mass edition

Which CVE IDs does GHSA-q8cr-xphm-7gfv cover?

GHSA-q8cr-xphm-7gfv covers the following CVE IDs: CVE-2017-1000009. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q8cr-xphm-7gfv?

GHSA-q8cr-xphm-7gfv has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-q8cr-xphm-7gfv?

GHSA-q8cr-xphm-7gfv affects 3 products, including: composer/akeneo/pim-community-dev:\u003e= 1.4, \u003c 1.4.28; composer/akeneo/pim-community-dev:\u003e= 1.5, \u003c 1.5.15; composer/akeneo/pim-community-dev:\u003e= 1.6, \u003c 1.6.6.

GHSA-q8cr-xphm-7gfvCriticalCVSS 9.8

Akeneo PIM vulnerable to shell injection in the mass edition

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

April 25, 2024

🔗 CVE IDs covered (1)

CVE-2017-1000009 →

📋 Description

Akeneo PIM CE and EE <1.6.6, <1.5.15, <1.4.28 are vulnerable to shell injection in the mass edition, resulting in remote execution.

🎯 Affected products3

composer/akeneo/pim-community-dev:>= 1.4, < 1.4.28
composer/akeneo/pim-community-dev:>= 1.5, < 1.5.15
composer/akeneo/pim-community-dev:>= 1.6, < 1.6.6

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2017-1000009
https://github.com/akeneo/pim-community-dev/blob/1.5/CHANGELOG-1.5.md#bug-fixes-2
https://github.com/akeneo/pim-community-dev/blob/master/CHANGELOG-1.4.md#bug-fixes
https://github.com/akeneo/pim-community-dev/blob/master/CHANGELOG-1.6.md#bug-fixes-2
https://github.com/advisories/GHSA-q8cr-xphm-7gfv