CVE-2021-37702: Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore
Pimcore is an open source data & experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The problem is patched in 10.1.1. Aside from upgrading, one may apply the patch manually as a workaround.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pimcore/pimcoreto a version that resolves this vulnerability.Fixed in 10.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2021-37702?
CVE-2021-37702 has been classified as a medium severity vulnerability due to its potential for formular injection during data object CSV import.
How do I fix CVE-2021-37702?
To fix CVE-2021-37702, upgrade to Pimcore version 10.1.1 or apply the provided patch manually.
What impact does CVE-2021-37702 have on systems?
The impact of CVE-2021-37702 allows attackers to perform formular injection through the CSV import feature, which could compromise data integrity.
Which versions of Pimcore are affected by CVE-2021-37702?
CVE-2021-37702 affects all versions of Pimcore prior to version 10.1.1.
Is there a workaround for CVE-2021-37702 if I cannot upgrade?
Yes, you can apply a manual patch as a workaround for CVE-2021-37702 if upgrading is not immediately possible.