UpHeron
All vulnerabilities

Servers and applications

CVE-2022-31092

Improper quoting of columns when using setOrderBy() or setGroupBy() on listing classes

Severity
High 8.1
Published
22 Jun 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
10.4.4
Also known as
GHSA-gvmf-wcx6-p974
Sources
NVD, Project advisories (GitHub)

Description

Pimcore is an Open Source Data & Experience Management Platform. Pimcore offers developers listing classes to make querying data easier. This listing classes also allow to order or group the results based on one or more columns which should be quoted by default. The actual issue is that quoting is not done properly in both cases, so there's the theoretical possibility to inject custom SQL if the…

Affected software

SoftwareAffected versions
PimcoreServers and applications · cpe:a:pimcore:pimcore
  • Every version before 10.4.4
PimcoreServers and applications · github:pimcore/pimcore
  • Every version before 10.4.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-31092
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-31092
  • GitHub Advisory Database https://github.com/advisories/GHSA-gvmf-wcx6-p974
  • github.com https://github.com/pimcore/pimcore/security/advisories/GHSA-gvmf-wcx6-p974