CVE-2024-9102 — Improper Neutralization of Formula Elements in a CSV File in Phpldapadmin

CWE-1236 — Improper Neutralization of Formula Elements in a CSV File4 documents4 sources
Severity
5.0MEDIUMNVD
EPSS
0.1%
top 65.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
PhpldapadminDebian Phpldapadmin
Timeline
PublishedDec 19

Description

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection. NOTE: This vulnerability will not be addressed, the maintainer's position is that it is not the intention of phpLDAPadmin to control what data Ad…

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:L

Affected Packages2 packages

▶CVEListV5phpldapadmin/phpldapadmin1.2.0, 1.2.6.7+1

🔴Vulnerability Details

2
GHSA
GHSA-p8hv-f2qg-cxvv: phpLDAPadmin since at least version 1↗2024-12-19
▶
OSV
CVE-2024-9102: phpLDAPadmin since at least version 1↗2024-12-19
▶

📋Vendor Advisories

1
Debian
CVE-2024-9102: phpldapadmin - phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 all...↗2024
▶