PT-2022-20520 · Pimcore · Pimcore

Highbrusch · Published 2022-06-22 · Updated 2022-07-08 · CVE-2022-31092

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 10.4.4

Description Pimcore is an Open Source Data & Experience Management Platform that offers developers listing classes to make querying data easier. These listing classes allow ordering or grouping results based on one or more columns, which should be quoted by default. However, quoting is not done properly, allowing the theoretical possibility to inject custom SQL if the developer uses these methods with input data and does not perform proper input validation in advance, relying on auto-quoting by the listing classes.

Recommendations For versions prior to 10.4.4, upgrade to version 10.4.4 or apply the patch manually to resolve the issue. As a temporary workaround, consider validating all input data before using it with the listing classes to minimize the risk of exploitation. Restrict access to the setOrderKey and setGroupBy methods to prevent unauthorized use until the issue is resolved. Avoid using user-provided input for the orderBy and groupBy parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-31092

GHSA-GVMF-WCX6-P974

Affected Products

Pimcore

References · 9

• 🔥 https://github.com/pimcore/pimcore/security/advisories/GHSA-gvmf-wcx6-p974 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31092.json · Exploit
• https://github.com/pimcore/pimcore/commit/21559c6bf0e4e828d33ff7af6e88caecb5ac6549 · Patch
• https://github.com/pimcore/pimcore/pull/12444 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31092 · Security Note
• https://osv.dev/vulnerability/GHSA-gvmf-wcx6-p974 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31092 · Vendor Advisory
• https://github.com/pimcore/pimcore · Note
• https://t.me/cibsecurity/45267 · Telegram Post