CVEvulnerability

CVE-2015-5349

7.8 HIGH Published 2016-04-11 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-04-11
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.8 HIGH — CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-77

Description

The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow attackers to execute arbitrary commands by leveraging a crafted LDAP entry that is interpreted as a formula when imported into a spreadsheet.

Affected configurations

• apache ldap studio 0.6.0 • apache ldap studio 0.7.0 • apache ldap studio 0.8.0 • apache ldap studio 0.8.1 • apache directory studio 1.0.0 • apache directory studio 1.0.1 • apache directory studio 1.1.0 • apache directory studio 1.2.0 • apache directory studio 1.3.0 • apache directory studio 1.4.0 • apache directory studio 1.5.0 • apache directory studio 1.5.1 • apache directory studio 1.5.2 • apache directory studio 1.5.3 • apache directory studio 2.0.0

Related

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References