GitHub Advisoryadvisory · Maven

GHSA-p9qj-4rjp-j3w9 Apache Directory Studio Command Injection

HIGH Published 2022-05-13 Modified 2023-12-07 Official page ↗
Aliases
CVE-2015-5349
Ecosystem
Maven
Packages
org.apache.directory.studio:org.apache.directory.studio.ldapbrowser.core
Severity
High
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-77
Reviewed
2023-08-01

Affected packages

• Maven org.apache.directory.studio:org.apache.directory.studio.ldapbrowser.core: < 2.0.0.v20151221-M10 → fixed in 2.0.0.v20151221-M10

Description

The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow attackers to execute arbitrary commands by leveraging a crafted LDAP entry that is interpreted as a formula when imported into a spreadsheet.

Related

Alias · CVE (1)

  • CVE-2015-5349 The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow… vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References