phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection. NOTE: This vulnerability will not be addressed, the maintainer's position is that it is not the intention of phpLDAPadmin to control what data Administrators can put in their LDAP database, nor filter it on export.
CVSS
No CVSS.
References
Configurations
No configuration.
History
16 Apr 2025, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| Summary | (en) phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection. NOTE: This vulnerability will not be addressed, the maintainer's position is that it is not the intention of phpLDAPadmin to control what data Administrators can put in their LDAP database, nor filter it on export. |
19 Dec 2024, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-12-19 14:15
Updated : 2025-04-16 12:15
NVD link : CVE-2024-9102
Mitre link : CVE-2024-9102
CVE.ORG link : CVE-2024-9102
JSON object : View
Products Affected
No product.
CWE
CWE-1236
Improper Neutralization of Formula Elements in a CSV File