Apache LDAP / Directory Studio Command Injection

2016.01.05
Risk: High
Local: No
Remote: Yes
CWE: CWE-78


Ogólna skala CVSS: 9.3/10
Znaczenie: 10/10
Łatwość wykorzystania: 8.6/10
Wymagany dostęp: Zdalny
Złożoność ataku: Średnia
Autoryzacja: Nie wymagana
Wpływ na poufność: Pełny
Wpływ na integralność: Pełny
Wpływ na dostępność: Pełny

CVE-2015-5349: Apache Directory Studio command injection vulnerability Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: - Apache LDAP Studio 0.6.0 to 0.8.1 - Apache Directory Studio 1.0.0 to 2.0.0-M9 Description: The CSV export didn?t escape the fields properly. Malicious users can put specially crafted values into the LDAP server. When a user exports that data into CSV formatted file, and subsequently opens it with a spreadsheet application, the data is interpreted as a formula and executed. Mitigation: Users should upgrade to Apache Directory Studio 2.0.0-M10 Credit: This issue was discovered by ?Muhammad Shahmeer Amir.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top