Lucene search

@huntrdevCVE-2022-1544

HistoryMay 01, 2022 - 12:15 p.m.

CVE-2022-1544

2022-05-0112:15:07

CWE-1236

@huntrdev

web.nvd.nist.gov

cve-2022-1544

formula injection

csv injection

github

luyadev/yii-helpers

nvd

security advisory

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

49.0%

JSON

Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data.

Affected configurations

Nvd

Node

luyayii-helpersRange<1.2.1

VendorProductVersionCPE
luyayii-helpers*cpe:2.3:a:luya:yii-helpers:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
luya	yii-helpers	*	cpe:2.3:a:luya:yii-helpers::::::::

CNA Affected

[
  {
    "product": "luyadev/yii-helpers",
    "vendor": "luyadev",
    "versions": [
      {
        "lessThan": "1.2.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/luyadev/yii-helpers/commit/9956ed63f516110c2b588471507b870e748c4cfb

huntr.dev/bounties/fa6d6e75-bc7a-40f6-9bdd-2541318912d4

Social References

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

49.0%

JSON

Related for CVE-2022-1544