What’s Vulnerable › Vulnerabilities

CVE-2023-2629: Improper Neutralization of Formula Elements in a CSV File in pimcore/customer-data-framework

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-05-10 · updated 2026-06-17
• Weakness: CWE-1236

Description

Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9.

Affected products

• pimcore/customer-data-framework: before 3.3.9 — fixed in 3.3.9

How to fix

Upgrade to a fixed version: pimcore/customer-data-framework 3.3.9. Check the vendor advisory for mitigations.

References

• https://github.com/pimcore/customer-data-framework/commit/4e0105c3a78d20686a0c010faef27d2297b98803
• https://huntr.dev/bounties/821ff465-4754-42d1-9376-813c17f16a01
• https://github.com/pimcore/customer-data-framework/commit/4e0105c3a78d20686a0c010faef27d2297b98803
• https://huntr.dev/bounties/821ff465-4754-42d1-9376-813c17f16a01

Get alerted when CVE-2023-2629 or the next vulnerability affects your stack