CVE-2021-27020 — Improper Neutralization of Formula Elements in a CSV File in Enterprise

CWE-1236 — Improper Neutralization of Formula Elements in a CSV File5 documents5 sources
Severity
8.8HIGHNVD
EPSS
0.5%
top 34.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Puppet Enterprise
Timeline
PublishedAug 30
Latest updateMay 24

Description

Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDpuppet/puppet_enterprise< 2019.8.6
▶CVEListV5puppet/puppet_enterprisePuppet Enterprise prior to 2019.8.6

🔴Vulnerability Details

3
GHSA
GHSA-wp6x-2jj2-vxhw: Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export↗2022-05-24
▶
CVEList
CVE-2021-27020: Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export↗2021-08-30
▶
OSV
CVE-2021-27020: Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export↗2021-08-30
▶

📋Vendor Advisories

1
Debian
CVE-2021-27020: puppet - Puppet Enterprise presented a security risk by not sanitizing user input when do...↗2021
▶
CVE-2021-27020 — Puppet Enterprise vulnerability | cvebase