CVE-2020-15255CWE-74

CSV injection in Anuko Time Tracker

High · published October 16, 2020

CVSS v3.1
8.7
EPSS
4%
Percentile
89.1
In the wild
Unconfirmed
What it is

In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet software (for example, when a cell value starts with an equal sign). This is fixed in version 1.19.23.5325.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.03504 · 89.1th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2020-10-16T16:20Z
EPSS history
Timeline
  • 16 OCT 16:20Z
    CSV injection in Anuko Time Tracker
    cvelistv5