CVE-2024-9102mediumCWE-1236

CVE-2024-9102: falha de média gravidade em phpLDAPadmin

phpLDAPadmin: Improper Neutralization of Formula Elements

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar phpLDAPadmin+ Monitorar phpldapadmin

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5epss 0.4%
phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection. NOTE: This vulnerability will not be addressed, the maintainer's position is that it is not the intention of phpLDAPadmin to control what data Administrators can put in their LDAP database, nor filter it on export.
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:L
Produtos afetados
phpLDAPadmin · phpLDAPadmin
CVEs relacionadas — phpLDAPadmin

No mesmo produto, das mais perigosas para as menos.

CVE-2024-9101LOWphpLDAPadmin: Reflected Cross-Site Scripting in entry_chooser.phpEPSS 0.5%