CVE-2022-46157

Remote php code execution in Akeneo PIM

Severity Score

8.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Akeneo PIM is an open source Product Information Management (PIM). Akeneo PIM Community Edition versions before v5.0.119 and v6.0.53 allows remote authenticated users to execute arbitrary PHP code on the server by uploading a crafted image. Akeneo PIM Community Edition after the versions aforementioned provides patched Apache HTTP server configuration file, for docker setup and in documentation sample, to fix this vulnerability. Community Edition users must change their Apache HTTP server configuration accordingly to be protected. The patch for Cloud Based Akeneo PIM Services customers has been applied since 30th October 2022. Users are advised to upgrade. Users unable to upgrade may Replace any reference to `<FilesMatch \.php$>` in their apache httpd configurations with: `<Location "/index.php">`.

Akeneo PIM es un software Product Information Management (PIM) de código abierto. Las versiones de Akeneo PIM Community Edition anteriores a v5.0.119 y v6.0.53 permiten a usuarios remotos autenticados ejecutar código PHP arbitrario en el servidor cargando una imagen manipulada. Akeneo PIM Community Edition después de las versiones antes mencionadas proporciona un archivo de configuración del servidor HTTP Apache parcheado, para la configuración de Docker y en una muestra de documentación, para corregir esta vulnerabilidad. Los usuarios de Community Edition deben cambiar la configuración de su servidor Apache HTTP en consecuencia para estar protegidos. El parche para los clientes de los servicios PIM de Akeneo basados en la nube se aplicó desde el 30 de octubre de 2022. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar pueden reemplazar cualquier referencia a `` en sus configuraciones httpd de Apache con: ``.

*Credits: N/A

CVSS Scores

NISTv3.1 8.8

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-11-28 CVE Reserved
2022-12-09 CVE Published
2024-07-01 EPSS Updated
2024-08-03 CVE Updated
2024-08-03 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-94: Improper Control of Generation of Code ('Code Injection')

CAPEC

References (2)

URL	Tag	Source
https://github.com/akeneo/pim-community-dev/security/advisories/GHSA-w9wc-4xcq-8gr6	Mitigation

URL	Date	SRC
https://github.com/akeneo/pim-community-dev/blob/b4d79bb073c8b68ea26ab227c97cc78d86c4cba1/docker/httpd.conf#L39	2024-08-03

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Akeneo Search vendor "Akeneo"		Product Information Management Search vendor "Akeneo" for product "Product Information Management"				< 5.0.119 Search vendor "Akeneo" for product "Product Information Management" and version " < 5.0.119"		community		Affected
Akeneo Search vendor "Akeneo"		Product Information Management Search vendor "Akeneo" for product "Product Information Management"				>= 6.0.0 < 6.0.53 Search vendor "Akeneo" for product "Product Information Management" and version " >= 6.0.0 < 6.0.53"		community		Affected