CVE-2022-26867CWE-1236

PowerStore SW v2.1.1.0 supports the option to export data to either a CSV or an XLSX file

Medium · published June 2, 2022

CVSS v3.1
5.9
EPSS
1%
Percentile
48.4
In the wild
Unconfirmed
What it is

PowerStore SW v2.1.1.0 supports the option to export data to either a CSV or an XLSX file. The data is taken as is, without any validation or sanitization. It allows a malicious, authenticated user to inject payloads that might get interpreted as formulas by the corresponding spreadsheet application that is being used to open the CSV/XLSX file.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00608 · 48.4th percentile
Weakness
CWE-1236 · Improper Neutralization of Formula Elements in a CSV File
Published
2022-06-02T21:00Z
EPSS history
Timeline
  • 02 JUN 21:00Z
    PowerStore SW v2.1.1.0 supports the option to export data to either a CSV or an XLSX file
    cvelistv5