CVE-2022-38844

{"id": "CVE-2022-38844", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}]}, "published": "2022-09-16T14:15:09.590", "references": [{"url": "https://medium.com/cybersecurity-valuelabs/espocrm-7-1-8-is-vulnerable-to-csv-injection-4c07494e2a76", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-1236"}]}], "descriptions": [{"lang": "en", "value": "CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands. Admin user exporting contacts in CSV file may end up executing the malicious system commands on his system."}, {"lang": "es", "value": "La inyecci\u00f3n de CSV en Create Contacts en EspoCRM versi\u00f3n 7.1.8, permite a usuarios remotos autenticados ejecutar comandos del sistema por medio de la creaci\u00f3n de contactos con cargas \u00fatiles capaces de ejecutar comandos del sistema. El usuario administrador que exporta los contactos en un archivo CSV puede terminar ejecutando los comandos maliciosos del sistema en su sistema"}], "lastModified": "2022-09-17T02:30:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:espocrm:espocrm:7.1.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D43B363E-F815-45B5-9012-8DA44D92F0FC"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}