cve.bz

CWE-1236: Improper Neutralization of Formula Elements in a CSV File, page 5

Filter

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

What the weakness is: CWE-1236 at MITRE

Ask an AI about CWE-1236

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-1236: Improper Neutralization of Formula Elements in a CSV File and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1236.html and https://cve.bz/cve/cwe/1236?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2020-36531EPSS 0.8%

    A vulnerability, which was classified as critical, has been found in SevOne Network Management System up to 5.7.2.22. This issue affects the Device Manager Page. An injection leads to privilege escalation. The attack may be initiated remot…

  2. 8.0CVE-2022-26867EPSS 0.6%

    PowerStore SW v2.1.1.0 supports the option to export data to either a CSV or an XLSX file. The data is taken as is, without any validation or sanitization. It allows a malicious, authenticated user to inject payloads that might get interpr…

  3. 9.8CVE-2022-28481EPSS 1.8%

    CSV-Safe gem < 3.0.0 doesn't filter out special characters which could trigger CSV Injection.

  4. 7.8CVE-2022-1544EPSS 2.4%

    Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, cod…

  5. 8.8CVE-2022-29315EPSS 1.5%

    Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV feature is used.

  6. 8.0CVE-2021-23286EPSS 0.4%

    Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to CSV Formula Injection. This issue affects: Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure…

  7. 7.8CVE-2021-43257EPSS 1.0%

    Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens the csv_export.php generated CSV file in Excel.

  8. 9.8CVE-2022-0142EPSS 2.9%

    The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.

  9. 7.8CVE-2021-43515EPSS 1.0%

    CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. By filling the Description field with malicious payload, it will be mistreated while exporting to a CSV file.

  10. 7.8CVE-2022-23868EPSS 0.7%

    RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file.

  11. 9.8CVE-2022-26249EPSS 1.9%

    Survey King v0.3.0 does not filter data properly when exporting excel files, allowing attackers to execute arbitrary code or access sensitive information via a CSV injection attack.

  12. 8.8CVE-2022-24770EPSS 1.3%

    `gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers from Improper Neutralization of Formula Elements in a CSV File. The `gradio` library has a flagging …

  13. 8.8CVE-2021-39022EPSS 0.5%

    IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command w…

  14. 7.8CVE-2021-46363EPSS 1.9%

    An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS files. These formulas may result in arbitrary code execution on a victim's computer when opening the exp…

  15. 8.8CVE-2022-22689EPSS 1.3%

    CA Harvest Software Change Manager versions 13.0.3, 13.0.4, 14.0.0, and 14.0.1, contain a vulnerability in the CSV export functionality, due to insufficient input validation, that can allow a privileged user to potentially execute arbitrar…

  16. 8.0CVE-2022-22121EPSS 1.2%

    In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection). A low privileged attacker can create a new table to inject payloads in the table rows. When an administrator accesses the User Manag…

  17. 9.8CVE-2021-23654EPSS 1.2%

    This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can…

  18. 6.5CVE-2021-41270EPSS 1.4%

    Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Symfony versions 4.1.0 before 4.4.35 and versions 5.0.0 before 5.3…

  19. 6.8CVE-2021-36334EPSS 0.7%

    Dell EMC CloudLink 7.1 and all prior versions contain a CSV formula Injection Vulnerability. A remote high privileged attacker, may potentially exploit this vulnerability, leading to arbitrary code execution on end user machine

  20. 7.8CVE-2021-38424EPSS 0.5%

    The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data. Those formulas may then be executed when it is opened with a spreadsheet application.

  21. 7.8CVE-2021-40848EPSS 1.0%

    In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interpret as a command, leading to execution of a malicious string locally on a device, aka CSV injection.

  22. 8.0CVE-2020-36503EPSS 1.2%

    The Connections Business Directory WordPress plugin before 9.7 does not validate or sanitise some connections' fields, which could lead to a CSV injection issue

  23. 6.8CVE-2021-37131EPSS 0.6%

    There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An attacker with high privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input valida…

  24. 9.8CVE-2021-38180EPSS 2.1%

    SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitation during the data export. An attacker could thereby execute arbitrary commands on the victim's com…

  25. 6.3CVE-2021-24016EPSS 0.5%

    An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file…

  26. 8.8CVE-2021-41824EPSS 1.4%

    Craft CMS before 3.7.14 allows CSV injection.

  27. 8.8CVE-2021-25962EPSS 1.1%

    “Shuup” application in versions 0.4.2 to 2.10.8 is affected by the “Formula Injection” vulnerability. A customer can inject payloads in the name input field in the billing address while buying a product. When a store administrator accesses…

  28. 8.0CVE-2021-25960EPSS 1.2%

    In “SuiteCRM” application, v7.11.18 through v7.11.19 and v7.10.29 through v7.10.31 are affected by “CSV Injection” vulnerability (Formula Injection). A low privileged attacker can use accounts module to inject payloads in the input fields.…

  29. 8.8CVE-2021-27020EPSS 1.1%

    Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export.

  30. 8.8CVE-2021-37702EPSS 1.1%

    Pimcore is an open source data & experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The problem is patched in 10.1.1. Aside from upgrading, one may apply the patch manually as a worka…

  31. 8.8CVE-2021-33256EPSS 79%

    A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The j_username parameter seems to be vulnerable and a reverse shell could be obtai…

  32. 7.3CVE-2021-22771EPSS 1.1%

    A CWE-1236: Improper Neutralization of Formula Elements in a CSV File vulnerability exists in Easergy T300 with firmware V2.7.1 and older that would allow arbitrary command execution.

  33. 7.8CVE-2020-25445EPSS 0.9%

    The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and …

  34. 8.0CVE-2021-24441EPSS 1.3%

    The Sign-up Sheets WordPress plugin before 1.0.14 does not not sanitise or validate the Sheet title when generating the CSV to export, which could lead to a CSV injection issue

  35. 8.8CVE-2020-22390EPSS 1.6%

    Akaunting <= 2.0.9 is vulnerable to CSV injection in the Item name field, export function. Attackers can inject arbitrary code into the name parameter and perform code execution when the crafted file is opened.

  36. 7.3CVE-2021-22153EPSS 1.0%

    A Remote Code Execution vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially cause the spreadsheet application to run com…

  37. 7.8CVE-2021-29667EPSS 1.2%

    IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Forc…

  38. 4.1CVE-2021-1475EPSS 0.8%

    Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to perform formula and link injection attacks on an affected device. For more info…

  39. 8.6CVE-2021-1474EPSS 0.7%

    Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to perform formula and link injection attacks on an affected device. For more info…

  40. 7.8CVE-2021-24144EPSS 1.2%

    Unvalidated input in the Contact Form 7 Database Addon plugin, versions before 1.2.5.6, was prone to a vulnerability that lets remote attackers inject arbitrary formulas into CSV files.

  41. 4.4CVE-2021-27839EPSS 0.7%

    A CSV injection vulnerability found in Online Invoicing System (OIS) 4.3 and below can be exploited by users to perform malicious actions such as redirecting admins to unknown or harmful websites, or disclosing other clients' details that …

  42. 7.2CVE-2021-21302EPSS 2.4%

    PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using shop search keywords via the admin panel. The problem is fixed in 1.7.7.2

  43. 4.9CVE-2020-9205EPSS 0.6%

    There has a CSV injection vulnerability in ManageOne 8.0.1. An attacker with common privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the atta…

  44. 9.8CVE-2021-3188EPSS 1.8%

    phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports.

  45. 7.8CVE-2020-9200EPSS 0.3%

    There has a CSV injection vulnerability in iManager NetEco 6000 versions V600R021C00. An attacker with common privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of…

  46. 6.5CVE-2019-16959EPSS 1.7%

    SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket.

  47. 5.3CVE-2020-28861EPSS 2.3%

    OpenAsset Digital Asset Management (DAM) 12.0.19 and earlier failed to implement access controls on /Stream/ProjectsCSV endpoint, allowing unauthenticated attackers to gain access to potentially sensitive project information stored by the …

  48. 8.8CVE-2020-4633EPSS 2.9%

    IBM Resilient SOAR V38.0 could allow a remote attacker to execute arbitrary code on the system, caused by formula injection due to improper input validation.

  49. 9.0CVE-2020-4627EPSS 1.6%

    IBM Cloud Pak for Security 1.3.0.1(CP4S) potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 185367.

  50. 7.8CVE-2020-28845EPSS 1.1%

    A CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated user to inject malicious payload in admin's portal thus leads to compromise admin's system.