CVE-2022-38844

CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of…

published September 16, 2022

CVSS
—
EPSS
1%
Percentile
71.7
In the wild
Unconfirmed
What it is

CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands. Admin user exporting contacts in CSV file may end up executing the malicious system commands on his system.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01369 · 71.7th percentile
Published
2022-09-16T13:25Z
EPSS history
Timeline
  • 16 SEP 13:25Z
    CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of…
    cvelistv5