PT-2019-12506

CVE-2019-11819

Published

2019-05-08

Updated

2022-05-24

Description by

CVSS 3.1

7.8

High

MetricsAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Alkacon OpenCMS versions 10.5.4 and before

Description The issue concerns CSV (aka Excel Macro) Injection in the New User module, specifically through the "First Name" or "Last Name" fields in the /opencms/system/workplace/admin/accounts/user new.jsp endpoint.

Recommendations For versions 10.5.4 and before, consider restricting access to the New User module until a fix is available, and avoid using the First Name or Last Name fields in the /opencms/system/workplace/admin/accounts/user new.jsp endpoint to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Pramod Rana

Vendors

Affected products

Weakness enumeration

CWE-1236: Improper Neutralization of Formula Elements in a CSV File

Related identifiers

CVE-2019-11819