CWE-1236

Improper Neutralization of Formula Elements in a CSV File

Parent: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

298 vulnerabilities with CWE-1236
CVE-2022-22689 HIGH
CA Harvest Software Change Manager <14.0.2 - RCE
CVSS 8.8
CVE-2022-22121 HIGH
NocoDB 0.81.0-0.83.8 - CSV Injection via User Management Export
CVSS 8.0
CVE-2021-47901 CRITICAL
dirsearch 0.4.1 - CSV Injection via Redirect Endpoint Path
CVSS 9.8
CVE-2021-38963 HIGH
IBM Aspera Console 3.4.0-3.4.4 - Command Injection
CVSS 8.0
CVE-2021-23286 MEDIUM
Eaton IPM Infrastructure <1.5.0plus205 - Code Injection
CVSS 5.7
CVE-2021-43257 HIGH
MantisBT < 2.25.3 - CSV Injection via CSV Export API
CVSS 7.8
CVE-2021-43515 HIGH
Kimai < 1.14.1 - CSV Injection via Timesheet Description Field
CVSS 7.8
CVE-2021-39022 HIGH
IBM Guardium Data Encryption <5.0.0.0 - Code Injection
CVSS 8.8
CVE-2021-46363 HIGH
Magnolia CMS < 6.2.4 - Formula Injection via CSV/XLS Export
CVSS 7.8
CVE-2021-23654 MEDIUM
html-to-csv - CSV Injection via Unvalidated Formula Embedding
CVSS 5.6
CVE-2021-41270 MEDIUM
Symfony <4.4.35 and <5.3.12 - Code Injection
CVSS 6.5
CVE-2021-36334 MEDIUM
Dell EMC CloudLink <7.1 - Code Injection
CVSS 5.9
CVE-2021-38424 MEDIUM
Delta Electronics DIALink <1.2.4.0 - Code Injection
CVSS 5.9
CVE-2021-40848 HIGH
Mahara < 20.04.5, 20.10.3, 21.04.2, 21.10.0 - CSV Injection via Exported CSV Files
CVSS 7.8
CVE-2021-37131 MEDIUM
Huawei ManageOne - CSV Injection via Insufficient Input Validation
CVSS 6.8
CVE-2021-38180 CRITICAL
SAP Business One 10.0 - Code Injection
CVSS 9.8
CVE-2021-24016 LOW
Fortinet FortiManager <6.4.3 - Command Injection
CVSS 3.7
CVE-2021-41824 HIGH
Craft CMS 3.4.0-3.7.13 - CSV Injection
CVSS 8.8
CVE-2021-25962 HIGH
Shuup 0.4.2-2.10.8 - Code Injection
CVSS 8.0
CVE-2021-25960 HIGH
SuiteCRM <7.11.19 & 7.10.31 - Code Injection
CVSS 8.0
CVE-2021-27020 HIGH
Puppet Enterprise - Info Disclosure
CVSS 8.8
CVE-2021-37702 HIGH
pimcore < 10.1.1 - Formula Injection via Data Object CSV Import
CVSS 8.0
CVE-2021-33256 HIGH
ManageEngine ADSelfService Plus <6.1.6101 - CSV Injection
CVSS 8.8
CVE-2021-22771 HIGH
Easergy T300 <V2.7.1 - Command Injection
CVSS 7.3
CVE-2021-24441 HIGH
Sign-up Sheets WP <1.0.14 - Code Injection
CVSS 8.0
Details
Vulnerabilities 298
Links
MITRE CWE Entry Search this CWE With Exploits