Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore · CVE-2021-37702 · GitHub Advisory Database · GitHub

Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore

Moderate severity GitHub Reviewed Published Aug 18, 2021 in pimcore/pimcore • Updated Feb 1, 2023

Package

pimcore/pimcore (Composer)

Affected versions

< 10.1.1

Patched versions

10.1.1

Description

Impact

Data Object CSV import allows formular injection.

Patches

Problem is patched in 10.1.1

Workarounds

Apply https://github.com/pimcore/pimcore/pull/9992.patch

References

https://cwe.mitre.org/data/definitions/1236.html

References

brusch published to pimcore/pimcore

Aug 18, 2021

Published by the National Vulnerability Database

Aug 18, 2021

Reviewed Aug 26, 2021

Published to the GitHub Advisory Database Aug 30, 2021

Last updated Feb 1, 2023