CVE-2024-9102mediumCWE-1236

CVE-2024-9102: fallo de gravedad media en phpLDAPadmin

phpLDAPadmin: Improper Neutralization of Formula Elements

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear phpLDAPadmin+ Monitorear phpldapadmin

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5epss 0.4%
phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection. NOTE: This vulnerability will not be addressed, the maintainer's position is that it is not the intention of phpLDAPadmin to control what data Administrators can put in their LDAP database, nor filter it on export.
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:L
Productos afectados
phpLDAPadmin · phpLDAPadmin
CVEs relacionadas — phpLDAPadmin

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-9101LOWphpLDAPadmin: Reflected Cross-Site Scripting in entry_chooser.phpEPSS 0.5%