{"id":"CVE-2022-1429","published":"2022-04-22T09:10:10Z","modified":"2024-08-03T00:03:06Z","title":"SQL injection in GridHelperService.php in pimcore/pimcore","vendor":"pimcore","product":"pimcore/pimcore","tier":"core","eol":null,"affectedVersions":[{"vendor":"pimcore","product":"pimcore/pimcore","versions":[">= unspecified, < 10.3.6"]}],"description":{"text":"SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6. This vulnerability is capable of steal the data","provenance":"source","from":"CVE.org"},"summary":{"text":"The SQL injection flaw lives in the GridHelperService.php component of the pimcore/pimcore product from pimcore, in versions prior to 10.3.6, where improper neutralisation of special elements in SQL commands allows query manipulation. An attacker who holds high-privilege credentials on a network-reachable instance can, with no user interaction required, exploit it to read or steal data, with the vulnerability also capable of affecting integrity and availability.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:16:13Z"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.63859,"percentile":0.99222,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://huntr.dev/bounties/cfba30b4-85fa-4499-9160-cd6e3119310e","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/pimcore/pimcore/commit/523a735ab94f004459b84ffdfd3db784586bbd82","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Packagist","package":"pimcore/pimcore","vulnerableRanges":["<10.3.6"],"patched":["10.3.6"],"from":["GHSA-2v7p-f4qm-r5pc"],"provenance":"source"}],"advisories":[{"id":"GHSA-2v7p-f4qm-r5pc","url":"https://github.com/advisories/GHSA-2v7p-f4qm-r5pc","severity":"HIGH","ecosystem":"Packagist","package":"pimcore/pimcore","vulnerableRanges":["<10.3.6"],"patched":["10.3.6"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-1599","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1599","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-04-22","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-1429","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":24.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.84,"detail":"percentile 0.9922"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.04,"detail":"base score 7.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2023-2730","published":"2023-05-16","fixed":"10.3.3","kev":false},{"cve":"CVE-2022-1219","published":"2022-04-08","fixed":"10.3.5","kev":false},{"cve":"CVE-2022-1339","published":"2022-04-13","fixed":"10.3.5","kev":false,"link":{"from":"CVE-2022-1339","to":"CVE-2022-1429","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:pimcore/pimcore","fromFixed":"10.3.5","toFixed":"10.3.6","daysApart":9},{"kind":"similar","provenance":"machine","score":0.42,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2022-1429","published":"2022-04-22","fixed":"10.3.6","kev":false},{"cve":"CVE-2022-0704","published":"2022-03-16","fixed":"10.4.0","kev":false},{"cve":"CVE-2022-0705","published":"2022-03-16","fixed":"10.4.0","kev":false},{"cve":"CVE-2022-0893","published":"2022-03-15","fixed":"10.4.0","kev":false}],"package":"Packagist:pimcore/pimcore"}}