LiveActive security incident?Get immediate response
CVE Record

CVE-2017-1000009: Akeneo PIM CE and EE <1.6.6, <1.5.15, <1.4.28 are vulnerable to shell injection in the mass edition, result...

Akeneo PIM CE and EE <1.6.6, <1.5.15, <1.4.28 are vulnerable to shell injection in the mass edition, resulting in remote execution.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This CVE describes a shell injection flaw in Akeneo PIM Community and Enterprise editions. The public record says vulnerable mass edition functionality can lead to remote execution. That means an attacker who can reach and trigger the vulnerable path could potentially run operating-system commands on the server.

Executive priority

Prioritize remediation where Akeneo PIM manages important product data or is reachable by many users. The age of the CVE lowers novelty, but remote execution impact makes unsupported or unpatched deployments unacceptable.

Technical view

Akeneo PIM CE and EE versions before 1.6.6, 1.5.15, and 1.4.28 are reported vulnerable to shell injection in mass edition. The source bundle provides no CVSS score, CWE, exploit prerequisites, authentication details, or technical patch diff.

Likely exposure

Exposure is most likely in organizations still running Akeneo PIM CE or EE 1.4, 1.5, or 1.6 below the fixed patch levels. The sources do not clarify internet exposure, authentication requirements, or configuration dependencies.

Exploitation context

CISA KEV is false, and the provided sources do not state active exploitation or public exploit availability. Treat it as serious because the stated impact is remote execution, but avoid assuming exploitation without local evidence.

Researcher notes

The public record is sparse. It identifies affected product families, version thresholds, and impact, but not root cause detail, authentication prerequisites, exploit maturity, or compensating controls. Validation should focus on version inventory and vendor changelog correlation.

Mitigation direction

  • Identify all Akeneo PIM CE and EE deployments and their exact versions.
  • Upgrade affected 1.4, 1.5, and 1.6 installations to the fixed patch level or later.
  • Check Akeneo vendor guidance and changelogs before choosing an upgrade path.
  • Restrict access to mass edition functionality to trusted, necessary users only.
  • Review server logs for unusual mass edition activity or unexpected command execution indicators.

Validation and detection

  • Confirm no deployment runs Akeneo PIM CE or EE below 1.4.28, 1.5.15, or 1.6.6.
  • Verify the mass edition feature is not exposed beyond intended users.
  • Review change records to confirm the relevant Akeneo patch release was applied.
  • Check monitoring for suspicious process launches from the Akeneo application context.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2017-1000009 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.