pimcore · pimcore/pimcore
The SQL injection flaw lives in the GridHelperService.php component of the pimcore/pimcore product from pimcore, in versions prior to 10.3.6, where improper neutralisation of special elements in SQL commands allows query manipulation. An attacker who holds high-privilege credentials on a network-reachable instance can, with no user interaction required, exploit it to read or steal data, with the vulnerability also capable of affecting integrity and availability.
SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6. This vulnerability is capable of steal the data
Disclosed on 22 Apr 2022. No public exploit code or confirmed exploitation is recorded.
7 fixes in pimcore/pimcore over 14 months. The latest fix listed for pimcore/pimcore is 10.4.0.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: pimcore/pimcore.
Upgrade to 10.5.19 or later
Fixes this CVE and 3 other known vulnerabilities in this package (CVE-2019-10867, CVE-2022-0832, +1).
Set the version to 10.5.19 or later in your composer.json.
First fixed in 10.3.6 for CVE-2022-1429.
| If you run | Upgrade to |
|---|---|
| All versions before 10.3.6 | 10.5.19first fix for this CVE: 10.3.6 |
“Up to” means the second version is the fix and is not affected.