CVE-2024-9102
phpLDAPadmin: Improper Neutralization of Formula Elements
Severity Score
5.0
*CVSS v4
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track
*SSVC
Descriptions
phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection.
*Credits:
Andreas Pfefferle, Redguard AG
CVSS Scores
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
System
Vulnerable | Subsequent
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-09-23 CVE Reserved
- 2024-12-19 CVE Published
- 2024-12-20 CVE Updated
- 2024-12-20 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-1236: Improper Neutralization of Formula Elements in a CSV File
CAPEC
- CAPEC-549: Local Execution of Code
References (3)
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
PhpLDAPadmin Search vendor "PhpLDAPadmin" | PhpLDAPadmin Search vendor "PhpLDAPadmin" for product "PhpLDAPadmin" | 1.2.0 Search vendor "PhpLDAPadmin" for product "PhpLDAPadmin" and version "1.2.0" | en |
Affected
| ||||||
PhpLDAPadmin Search vendor "PhpLDAPadmin" | PhpLDAPadmin Search vendor "PhpLDAPadmin" for product "PhpLDAPadmin" | 1.2.6.7 Search vendor "PhpLDAPadmin" for product "PhpLDAPadmin" and version "1.2.6.7" | en |
Affected
|