PT-2019-12506

CVE-2019-11819

Publicado

2019-05-08

Atualizado

2022-05-24

Descrição por

CVSS 3.1

7.8

Alta

MétricasAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Alkacon OpenCMS versions 10.5.4 and before

Description The issue concerns CSV (aka Excel Macro) Injection in the New User module, specifically through the "First Name" or "Last Name" fields in the /opencms/system/workplace/admin/accounts/user new.jsp endpoint.

Recommendations For versions 10.5.4 and before, consider restricting access to the New User module until a fix is available, and avoid using the First Name or Last Name fields in the /opencms/system/workplace/admin/accounts/user new.jsp endpoint to minimize the risk of exploitation.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Pramod Rana

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-1236: Improper Neutralization of Formula Elements in a CSV File

Identificadores relacionados

CVE-2019-11819