PT-2016-3686

CVE-2015-5349

·

Published

2016-04-11

·

Updated

2022-05-13

Description by

CVSS 2.0
9.3
High
MetricsAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Apache LDAP Studio and Apache Directory Studio versions prior to 2.0.0-M10
Description The issue concerns the CSV export functionality, which fails to properly escape field values. This could allow attackers to execute arbitrary commands by crafting a specific LDAP entry that is interpreted as a formula when imported into a spreadsheet.
Recommendations For versions prior to 2.0.0-M10, update to version 2.0.0-M10 or later to resolve the issue.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')
Related identifiers
CVE-2015-5349
GHSA-P9QJ-4RJP-J3W9
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com