Lucene search

[email protected]CVE-2015-5349

HistoryApr 11, 2016 - 9:59 p.m.

CVE-2015-5349

2016-04-1121:59:00

CWE-77

[email protected]

web.nvd.nist.gov

cve

apache

ldap

directory studio

csv

export

vulnerability

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

39.3%

JSON

The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow attackers to execute arbitrary commands by leveraging a crafted LDAP entry that is interpreted as a formula when imported into a spreadsheet.

CPENameOperatorVersion
apache:ldap_studioapache ldap studioeq0.6.0
apache:ldap_studioapache ldap studioeq0.7.0
apache:ldap_studioapache ldap studioeq0.8.0
apache:ldap_studioapache ldap studioeq0.8.1
apache:directory_studioapache directory studioeq1.0.0
apache:directory_studioapache directory studioeq1.0.1
apache:directory_studioapache directory studioeq1.1.0
apache:directory_studioapache directory studioeq1.2.0
apache:directory_studioapache directory studioeq1.3.0
apache:directory_studioapache directory studioeq1.4.0

CPE	Name	Operator	Version
apache:ldap_studio	apache ldap studio	eq	0.6.0
apache:ldap_studio	apache ldap studio	eq	0.7.0
apache:ldap_studio	apache ldap studio	eq	0.8.0
apache:ldap_studio	apache ldap studio	eq	0.8.1
apache:directory_studio	apache directory studio	eq	1.0.0
apache:directory_studio	apache directory studio	eq	1.0.1
apache:directory_studio	apache directory studio	eq	1.1.0
apache:directory_studio	apache directory studio	eq	1.2.0
apache:directory_studio	apache directory studio	eq	1.3.0
apache:directory_studio	apache directory studio	eq	1.4.0

Rows per page:

1-10 of 151

References

www.securityfocus.com/archive/1/537225/100/0/threaded

directory.apache.org/studio/news.html

lists.apache.org/thread.html/reb5443aaf781b364896ee9d7cf6e97fdc4f5a5174132c319252963b6%40%3Ccommits.directory.apache.org%3E

Social References

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

39.3%

JSON

Related for CVE-2015-5349

osv1 prion1 github1 cvelist1 debiancve1