PT-2018-6639 · Silverstripe+1 · Silverstripe+1

Publicado 2018-01-23 · Atualizado 2022-05-14 · CVE-2017-18049

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: SilverStripe versions prior to 3.5.6 SilverStripe versions 3.6.x prior to 3.6.3 SilverStripe versions 4.x prior to 4.0.1

Description: The issue concerns the CSV export feature, where the output may contain macros and scripts. These can be executed if the CSV file is imported into common software, such as Microsoft Excel, without proper sanitization. The CSV data may include untrusted user input, for example, from the First Name field of a user's /myprofile page.

Recommendations: For SilverStripe versions prior to 3.5.6, update to version 3.5.6 or later. For SilverStripe versions 3.6.x prior to 3.6.3, update to version 3.6.3 or later. For SilverStripe versions 4.x prior to 4.0.1, update to version 4.0.1 or later.

Exploit

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2017-18049

GHSA-2JVJ-MHF2-G99W

Produtos afetados

Office Excel

Silverstripe

Referências · 6

• 🔥 https://exploit-db.com/exploits/43396 · Exploit
• https://github.com/silverstripe/silverstripe-framework · Nota
• https://osv.dev/vulnerability/GHSA-2jvj-mhf2-g99w · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-18049 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-18049 · Nota de Segurança
• https://silverstripe.org/download/security-releases/ss-2017-007 · Aviso do Fabricante