Miggo Logo
Miggo Vulnerability Database
→
GHSA-hq76-662x-7mw4

GHSA-hq76-662x-7mw4:
Pimcore includes vulnerable PHPOffice/PhpSpreadsheet

8.8

CVSS Score
3.1

Basic Information

CVE ID
-
GHSA ID
GHSA-hq76-662x-7mw4
EPSS Score
-
CWE
-
Published
9/3/2024
Updated
9/3/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
pimcore/data-importercomposer< 1.8.91.8.9
pimcore/data-importercomposer>= 1.9.0, < 1.9.31.9.3
pimcore/admin-ui-classic-bundlecomposer< 1.3.111.3.11
pimcore/admin-ui-classic-bundlecomposer>= 1.4.0, < 1.4.71.4.7
pimcore/admin-ui-classic-bundlecomposer>= 1.5.0, < 1.5.41.5.4
pimcore/pimcorecomposer>= 10.6.9.0, < 10.6.9.1210.6.9.12
pimcore/pimcorecomposer>= 11.1.0.0, < 11.1.6.1111.1.6.11

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability (CVE-2024-45048) stems from PHPOffice/PhpSpreadsheet's XML parsing logic. The XmlScanner::getEncoding function fails to properly sanitize encoding attributes using single quotes, enabling XXE. Pimcore inherits this vulnerability via its dependency on PhpSpreadsheet <1.29.1/2.2.2. The IOFactory::load method is the entry point for processing Excel files, making it a critical vulnerable function. Both functions are part of the PhpSpreadsheet library, which is included in Pimcore's affected packages (e.g., data-importer, admin-ui-classic-bundle).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Summ*ry Pim*or* **.*.x *n* *nt*rpris* **.*.x v*rsions *urr*ntly **p*n* on P*PO**i**/P*pSpr***s***t v*rsion *.x, w*i** **s r***ntly ***n i**nti*i** wit* * s**urity vuln*r**ility (*V*-****-*****). To miti**t* t*is issu*, it is r**omm*n*** to up**t*

Reasoning

T** vuln*r**ility (*V*-****-*****) st*ms *rom P*PO**i**/P*pSpr***s***t's XML p*rsin* lo*i*. T** `XmlS**nn*r::**t*n*o*in*` *un*tion **ils to prop*rly s*nitiz* *n*o*in* *ttri*ut*s usin* sin*l* quot*s, *n**lin* XX*. Pim*or* in**rits t*is vuln*r**ility v