PT-2016-3686 · Apache · Apache Ldap Studio+1

Muhammad Shahmeer Amir · Publicado 2016-04-11 · Atualizado 2022-05-13 · CVE-2015-5349

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache LDAP Studio and Apache Directory Studio versions prior to 2.0.0-M10

Description The issue concerns the CSV export functionality, which fails to properly escape field values. This could allow attackers to execute arbitrary commands by crafting a specific LDAP entry that is interpreted as a formula when imported into a spreadsheet.

Recommendations For versions prior to 2.0.0-M10, update to version 2.0.0-M10 or later to resolve the issue.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2015-5349

GHSA-P9QJ-4RJP-J3W9

Produtos afetados

Apache Directory Studio

Apache Ldap Studio

Referências · 10

• https://github.com/apache/directory-studio/commit/ac57a26fcb98aa17fe9534575cf5fdad00a1c839 · Nota
• https://github.com/apache/directory-studio · Nota
• https://directory.apache.org/studio/news.html · Aviso do Fabricante
• https://lists.apache.org/thread.html/reb5443aaf781b364896ee9d7cf6e97fdc4f5a5174132c319252963b6%40%3Ccommits.directory.apache.org%3E · Nota
• https://web.archive.org/web/20201209040832/http://securityfocus.com/archive/1/537225/100/0/threaded · Nota
• https://osv.dev/vulnerability/GHSA-p9qj-4rjp-j3w9 · Aviso do Fabricante
• https://t.me/cvenotify/18077 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2015-5349 · Nota de Segurança
• http://securityfocus.com/archive/1/537225/100/0/threaded · Nota
• https://lists.apache.org/thread.html/reb5443aaf781b364896ee9d7cf6e97fdc4f5a5174132c319252963b6@%3Ccommits.directory.apache.org%3E · Nota