CVE-2024-9102
phpLDAPadmin: Improper Neutralization of Formula Elements
概要
phpLDAPadmin: Improper Neutralization of Formula Elements
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection. NOTE: This vulnerability will not be addressed, the maintainer's position is that it is not the intention of phpLDAPadmin to control what data Administrators can put in their LDAP database, nor filter it on export.
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2024-9102 phpldapadmin
- Ubuntu UBUNTU-CVE-2024-9102 phpldapadmin
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory redguard.ch
- package github.com
- package github.com
- patch github.com
- report github.com
- web sourceforge.net