CVE-2022-46157

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-46157
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-46157.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-46157
Aliases
Published
2022-12-09T20:14:33.460Z
Modified
2026-04-10T04:52:35.667622Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Remote php code execution in Akeneo PIM
Details

Akeneo PIM is an open source Product Information Management (PIM). Akeneo PIM Community Edition versions before v5.0.119 and v6.0.53 allows remote authenticated users to execute arbitrary PHP code on the server by uploading a crafted image. Akeneo PIM Community Edition after the versions aforementioned provides patched Apache HTTP server configuration file, for docker setup and in documentation sample, to fix this vulnerability. Community Edition users must change their Apache HTTP server configuration accordingly to be protected. The patch for Cloud Based Akeneo PIM Services customers has been applied since 30th October 2022. Users are advised to upgrade. Users unable to upgrade may Replace any reference to <FilesMatch \.php$> in their apache httpd configurations with: <Location "/index.php">.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46157.json"
}
References

Affected packages

Git / github.com/akeneo/pim-community-dev

Affected ranges

Type
GIT
Repo
https://github.com/akeneo/pim-community-dev
Events
Introduced
3dd7c96c3ba372520ba3e82e70b8ae0bc82b63e4
Fixed
6434a16d7fdeb78a909b118523a5c55ce9e2d4fb
Database specific 
{
    "versions": [
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.0.53"
        }
    ]
}
Type
GIT
Repo
https://github.com/akeneo/pim-community-dev
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b6ea26d696d8bd183c3097cee4664850cba33b97
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.0.119"
        }
    ]
}

Affected versions

v1.*
v1.0.0-ALPHA1
v1.0.0-ALPHA2
v1.0.0-ALPHA3
v1.0.0-ALPHA4
v1.0.0-BETA2-sprint25
v1.0.0-BETA3-sprint28
v1.0.0-BETA4-sprint30
v1.0.0-RC1
v1.0.0-RC1-sprint31
v1.0.0-sprint34
v1.1.0
v1.1.0-RC1
v1.1.0-RC2
v1.1.0-RC3
v1.2.0
v1.2.0-BETA1
v1.2.0-BETA2
v1.2.0-RC1
v1.2.0-RC3
v1.2.0-RC4
v1.3.0-BETA1
v1.3.0-RC1
v1.4.0-ALPHA1
v1.4.0-BETA1
v1.4.0-BETA2
v1.4.0-BETA3
v1.4.0-RC1
v1.5.0-ALPHA1
v1.6.0-ALPHA1
v1.6.0-ALPHA2
v2.*
v2.0.0
v2.0.0-ALPHA1
v2.0.0-BETA1
v2.1.0-ALPHA1
v5.*
v5.0.0
v5.0.1
v5.0.10
v5.0.100
v5.0.101
v5.0.102
v5.0.103
v5.0.104
v5.0.105
v5.0.106
v5.0.107
v5.0.108
v5.0.109
v5.0.11
v5.0.110
v5.0.111
v5.0.112
v5.0.113
v5.0.114
v5.0.115
v5.0.116
v5.0.117
v5.0.118
v5.0.12
v5.0.13
v5.0.14
v5.0.15
v5.0.16
v5.0.17
v5.0.18
v5.0.19
v5.0.2
v5.0.20
v5.0.21
v5.0.22
v5.0.23
v5.0.24
v5.0.25
v5.0.26
v5.0.27
v5.0.28
v5.0.29
v5.0.3
v5.0.30
v5.0.31
v5.0.32
v5.0.33
v5.0.34
v5.0.35
v5.0.36
v5.0.37
v5.0.38
v5.0.39
v5.0.4
v5.0.40
v5.0.41
v5.0.42
v5.0.43
v5.0.44
v5.0.45
v5.0.46
v5.0.47
v5.0.48
v5.0.49
v5.0.5
v5.0.50
v5.0.51
v5.0.52
v5.0.53
v5.0.54
v5.0.55
v5.0.56
v5.0.57
v5.0.58
v5.0.59
v5.0.6
v5.0.60
v5.0.61
v5.0.62
v5.0.63
v5.0.64
v5.0.65
v5.0.66
v5.0.67
v5.0.68
v5.0.69
v5.0.7
v5.0.70
v5.0.71
v5.0.72
v5.0.73
v5.0.74
v5.0.75
v5.0.76
v5.0.77
v5.0.78
v5.0.79
v5.0.8
v5.0.80
v5.0.81
v5.0.82
v5.0.83
v5.0.84
v5.0.85
v5.0.86
v5.0.87
v5.0.88
v5.0.89
v5.0.9
v5.0.90
v5.0.91
v5.0.92
v5.0.93
v5.0.94
v5.0.95
v5.0.96
v5.0.97
v5.0.98
v5.0.99
v6.*
v6.0.0
v6.0.1
v6.0.10
v6.0.11
v6.0.12
v6.0.13
v6.0.14
v6.0.15
v6.0.16
v6.0.17
v6.0.18
v6.0.19
v6.0.2
v6.0.20
v6.0.21
v6.0.22
v6.0.23
v6.0.24
v6.0.25
v6.0.26
v6.0.27
v6.0.28
v6.0.29
v6.0.3
v6.0.30
v6.0.31
v6.0.32
v6.0.33
v6.0.34
v6.0.35
v6.0.36
v6.0.37
v6.0.38
v6.0.39
v6.0.4
v6.0.40
v6.0.41
v6.0.42
v6.0.43
v6.0.44
v6.0.45
v6.0.46
v6.0.47
v6.0.48
v6.0.49
v6.0.5
v6.0.50
v6.0.51
v6.0.52
v6.0.6
v6.0.7
v6.0.8
v6.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-46157.json"