cve.bz

CWE-1236: Improper Neutralization of Formula Elements in a CSV File, page 6

Filter

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

What the weakness is: CWE-1236 at MITRE

Ask an AI about CWE-1236

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-1236: Improper Neutralization of Formula Elements in a CSV File and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1236.html and https://cve.bz/cve/cwe/1236?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2020-15301EPSS 0.8%

    SuiteCRM through 7.11.13 allows CSV Injection via registration fields in the Accounts, Contacts, Opportunities, and Leads modules. These fields are mishandled during a Download Import File Template operation.

  2. 7.8CVE-2020-4759EPSS 2.0%

    IBM FileNet Content Manager 5.5.4 and 5.5.5 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 188736.

  3. 7.8CVE-2020-25170EPSS 1.0%

    An Excel Macro Injection vulnerability exists in the export feature in the B. Braun OnlineSuite Version AP 3.0 and earlier via multiple input fields that are mishandled in an Excel export.

  4. 7.8CVE-2020-26507EPSS 1.0%

    A CSV Injection (also known as Formula Injection) vulnerability in the Marmind web application with version 4.1.141.0 allows malicious users to gain remote control of other computers. By providing formula code in the “Notes” functionality …

  5. 8.8CVE-2020-25398EPSS 2.0%

    CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality.

  6. 9.8CVE-2020-22274EPSS 1.6%

    JomSocial (Joomla Social Network Extention) 4.7.6 allows CSV injection via a customer's profile.

  7. 8.8CVE-2020-22278EPSS 1.5%

    phpMyAdmin through 5.0.2 allows CSV injection via Export Section. NOTE: the vendor disputes this because "the CSV file is accurately generated based on the database contents.

  8. 8.0CVE-2020-22277EPSS 1.8%

    Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.

  9. 9.8CVE-2020-22276EPSS 3.0%

    WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry.

  10. 8.8CVE-2020-22275EPSS 2.2%

    Easy Registration Forms (ER Forms) Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, when the system administrator generates CSV output from the forms information, there is no check on th…

  11. 7.8CVE-2020-24707EPSS 1.3%

    Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content.

  12. 7.3CVE-2020-15255ExploitEPSS 3.5%

    In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet software (for example, when a cell value starts with an equa…

  13. 6.8CVE-2020-4689EPSS 2.4%

    IBM Security Guardium 11.2 is vulnerable to CVS Injection. A remote privileged attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-ForceID: 186696.

  14. 7.8CVE-2020-4302EPSS 1.7%

    IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to execute arbitrary code on the system, caused by a CSV injection. By persuading a victim to open a specially-crafted excel file, an attacker could exploit this vulnerabilit…

  15. 8.8CVE-2020-14026EPSS 1.7%

    CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the Export Of Contacts feature in Ozeki NG SMS Gateway through 4.17.6 via a value that is mishandled in a CSV export.

  16. 5.0CVE-2020-16214EPSS 0.6%

    In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the software saves user-provided information into a comma-separated value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could …

  17. 8.8CVE-2020-13826EPSS 1.5%

    A CSV injection (aka Excel Macro Injection or Formula Injection) issue in i-doit 1.14.2 allows an attacker to execute arbitrary commands via a Title parameter that is mishandled in a CSV export.

  18. 6.3CVE-2020-10780EPSS 0.7%

    Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possi…

  19. 7.3CVE-2020-7049EPSS 0.9%

    Nozomi Networks OS before 19.0.4 allows /#/network?tab=network_node_list.html CSV Injection.

  20. 7.3CVE-2020-13247EPSS 1.0%

    BooleBox Secure File Sharing Utility before 4.2.3.0 allows CSV injection via a crafted user name that is mishandled during export from the activity logs in the Audit Area.

  21. 8.8CVE-2020-13146EPSS 1.1%

    Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in Course>Instructor>Cohorts may contain a formula that is exported via the "Course>Data Downloads>Reports>Download profile info" feature.

  22. 7.8CVE-2019-20002EPSS 1.3%

    Formula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a value (provided by a low-privileged user in the Subject field of a help request form) that is mishandled in a TicketActions/view?tab=group TSV export by …

  23. 9.8CVE-2020-11548EPSS 5.2%

    The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution via CSV injection if a wp-admin/index.php?page=search-meter Export is p…

  24. 9.8CVE-2020-7947EPSS 2.8%

    An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validat…

  25. 9.6CVE-2019-19676EPSS 1.3%

    A CSV injection in arxes-tolina 3.0.0 allows malicious users to gain remote control of other computers. By entering formula code in the following columns: Kundennummer, Firma, Street, PLZ, Ort, Zahlziel, and Bemerkung, an attacker can crea…

  26. 9.8CVE-2020-9347EPSS 7.8%

    Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by the Export Passwords feature. NOTE: the vendor disputes the significance of this report because they…

  27. 4.9CVE-2020-10460EPSS 1.1%

    admin/include/operations.php (via admin/email-harvester.php) in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject untrusted input inside CSV files via the POST parameter data.

  28. 7.8CVE-2020-9372ExploitEPSS 8.6%

    The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.…

  29. 6.1CVE-2020-9466EPSS 1.3%

    The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection.

  30. 8.0CVE-2020-9017EPSS 1.1%

    LiteCart through 2.2.1 allows CSV injection via a customer's profile.

  31. 7.8CVE-2019-20184EPSS 1.6%

    KeePass 2.4.1 allows CSV injection in the title field of a CSV export.

  32. 6.8CVE-2019-20180EPSS 2.3%

    The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users. Note: The vendor disputes this issue and argues that this responsibility lies with the application that opens the CSV file and not TablePress.

  33. 6.5CVE-2019-13181EPSS 3.2%

    A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7.

  34. 9.8CVE-2019-0403EPSS 2.1%

    SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to CSV Command Injection.

  35. 9.8CVE-2019-4521EPSS 2.6%

    Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 165179.

  36. 6.5CVE-2019-6187EPSS 0.9%

    A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that coul…

  37. 8.8CVE-2019-17661EPSS 2.4%

    A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a us…

  38. 4.3CVE-2019-11275EPSS 1.1%

    Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability whe…

  39. 9.8CVE-2019-16184EPSS 1.7%

    A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey responses that will be included in the export CSV file.

  40. 8.8CVE-2019-16120EPSS 3.2%

    CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees feature.

  41. 4.9CVE-2019-6182EPSS 0.7%

    A stored CSV Injection vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow an administrative user to store malformed data in LXCA Jobs and Event Log data, that could result in crafted…

  42. 7.3CVE-2019-15092ExploitEPSS 5.1%

    The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExp…

  43. 5.5CVE-2018-19855EPSS 1.1%

    UiPath Orchestrator before 2018.3.4 allows CSV Injection, related to the Audit export, Robot log export, and Transaction log export features.

  44. 8.8CVE-2019-14749ExploitEPSS 9.6%

    An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. CSV (aka Formula) injection exists in the export spreadsheets functionality. These spreadsheets are generated dynamically from unvalidated or unfiltered user input…

  45. 7.8CVE-2019-14352EPSS 1.0%

    In Joget Workflow 6.0.20, CSV Injection, also known as Formula Injection, exists, as demonstrated by jw/web/userview/crm_community/crm_userview_sales/_/account_new with the Account ID or Account Name field. NOTE: the vendor disputes the re…

  46. 9.8CVE-2019-13144EPSS 1.8%

    myTinyTodo 1.3.3 through 1.4.3 allows CSV Injection. This is fixed in 1.5.

  47. 8.8CVE-2019-12961EPSS 1.4%

    LiveZilla Server before 8.0.1.1 is vulnerable to CSV Injection in the Export Function.

  48. 8.0CVE-2019-4364EPSS 2.6%

    IBM Maximo Asset Management 7.6 is vulnerable to CSV injection, which could allow a remote authenticated attacker to execute arbirary commands on the system. IBM X-Force ID: 161680.

  49. 8.8CVE-2018-20468EPSS 2.2%

    An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A web reports module has "export to excel features" that are vulnerable to CSV injection. An attacker can embed Excel formulas inside an automation script that, when exporte…

  50. 9.8CVE-2019-12765ExploitEPSS 10%

    An issue was discovered in Joomla! before 3.9.7. The CSV export of com_actionslogs is vulnerable to CSV injection.