CVE-2016-1000222

HIGH

Logstash < 2.1.1 - Argument Injection via CSV Output

Title source: llm
STIX 2.1

Description

Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data.

References (1)

Core 1
Core References
Vendor Advisory x_refsource_confirm
https://www.elastic.co/community/security

Scores

CVSS v3 7.5
EPSS 0.0035
EPSS Percentile 57.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-88
Status published
Products (1)
elastic/logstash < 2.1.1
Published Jun 16, 2017
Tracked Since Feb 18, 2026