CVE-2024-9102 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection.

Reserved 2024-09-23 | Published 2024-12-19 | Updated 2024-12-20 | Assigner NCSC.ch

MEDIUM: 5.0CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:L

Problem types

CWE-1236 Improper Neutralization of Formula Elements in a CSV File

Product status

Default status

affected

1.2.0

affected

1.2.6.7

affected

Credits

Andreas Pfefferle, Redguard AG finder

References

www.redguard.ch/...024/12/19/security-advisory-phpldapadmin/ third-party-advisory

github.com/...ommit/ea17aadef46fd29850160987fe7740ceed1381ad

sourceforge.net/...hpldapadmin/files/phpldapadmin-php5/1.2.0

cve.org (CVE-2024-9102)

nvd.nist.gov (CVE-2024-9102)

Download JSON

https://cve.threatint.com/CVE/CVE-2024-9102

Support options

Helpdesk Chat, Email, Knowledgebase

Subscribe to our newsletter to learn more about our work.