Lucene search

K
cve[email protected]CVE-2020-5299
HistoryJun 03, 2020 - 10:15 p.m.

CVE-2020-5299

2020-06-0322:15:11
CWE-77
web.nvd.nist.gov
42
2
cve-2020-5299
octobercms
csv injection
security vulnerability
patch

5.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L

5.1 Medium

AI Score

Confidence

High

4.6 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:S/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

49.6%

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, any users with the ability to modify any data that could eventually be exported as a CSV file from the ImportExportController could potentially introduce a CSV injection into the data to cause the generated CSV export file to be malicious. This requires attackers to achieve the following before a successful attack can be completed: 1. Have found a vulnerability in the victims spreadsheet software of choice. 2. Control data that would potentially be exported through the ImportExportController by a theoretical victim. 3. Convince the victim to export above data as a CSV and run it in vulnerable spreadsheet software while also bypassing any sanity checks by said software. Issue has been patched in Build 466 (v1.0.466).

Affected configurations

Vulners
NVD
Node
octobercmsoctoberRange1.0.3191.0.466
VendorProductVersionCPE
octobercmsoctober*cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*

CNA Affected

[
  {
    "product": "october",
    "vendor": "octobercms",
    "versions": [
      {
        "status": "affected",
        "version": ">= 1.0.319, < 1.0.466"
      }
    ]
  }
]

Social References

More

5.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L

5.1 Medium

AI Score

Confidence

High

4.6 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:S/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

49.6%