CVE-2024-9102mediumCWE-1236

CVE-2024-9102: medium-severity vulnerability in phpLDAPadmin

phpLDAPadmin: Improper Neutralization of Formula Elements

Published · Updated

Follow this CVE+ Monitor phpLDAPadmin+ Monitor phpldapadmin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5epss 0.4%
phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection. NOTE: This vulnerability will not be addressed, the maintainer's position is that it is not the intention of phpLDAPadmin to control what data Administrators can put in their LDAP database, nor filter it on export.
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:L
Affected products
phpLDAPadmin · phpLDAPadmin
Related CVEs — phpLDAPadmin

In the same product, most dangerous first.

CVE-2024-9101LOWphpLDAPadmin: Reflected Cross-Site Scripting in entry_chooser.phpEPSS 0.5%