CVE-2021-1474CWE-1236

Cisco Umbrella Link and CSV Formula Injection Vulnerabilities

Medium · published April 8, 2021

CVSS v3.1
6.5
EPSS
1%
Percentile
53.5
In the wild
Unconfirmed
What it is

Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to perform formula and link injection attacks on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00722 · 53.5th percentile
Weakness
CWE-1236 · Improper Neutralization of Formula Elements in a CSV File
Published
2021-04-08T04:07Z
EPSS history
Timeline
  • 08 APR 04:07Z
    Cisco Umbrella Link and CSV Formula Injection Vulnerabilities
    cvelistv5