CVE-2024-9102CWE-1236

phpLDAPadmin: Improper Neutralization of Formula Elements

Medium · published December 19, 2024

CVSS v4.0
5.0
EPSS
0%
Percentile
35.1
In the wild
Unconfirmed
What it is

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection. NOTE: This vulnerability will not be addressed, the maintainer's position is that it is not the intention of phpLDAPadmin to control what data Administrators can put in their LDAP database, nor filter it on export.

The record
Technical detail
CVSS v4.0
5.0 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:L
EPSS
0.00419 · 35.1th percentile
Weakness
CWE-1236 · Improper Neutralization of Formula Elements in a CSV File
Published
2024-12-19T13:41Z
EPSS history
Timeline
  • 19 DEC 13:41Z
    phpLDAPadmin: Improper Neutralization of Formula Elements
    cvelistv5