PT-2016-3686 · Apache · Apache Ldap Studio+1

Muhammad Shahmeer Amir · Published 2016-04-11 · Updated 2022-05-13 · CVE-2015-5349

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache LDAP Studio and Apache Directory Studio versions prior to 2.0.0-M10

Description The issue concerns the CSV export functionality, which fails to properly escape field values. This could allow attackers to execute arbitrary commands by crafting a specific LDAP entry that is interpreted as a formula when imported into a spreadsheet.

Recommendations For versions prior to 2.0.0-M10, update to version 2.0.0-M10 or later to resolve the issue.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2015-5349

GHSA-P9QJ-4RJP-J3W9

Affected Products

Apache Directory Studio

Apache Ldap Studio

References · 10

• https://directory.apache.org/studio/news.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p9qj-4rjp-j3w9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5349 · Security Note
• https://github.com/apache/directory-studio/commit/ac57a26fcb98aa17fe9534575cf5fdad00a1c839 · Note
• https://github.com/apache/directory-studio · Note
• https://lists.apache.org/thread.html/reb5443aaf781b364896ee9d7cf6e97fdc4f5a5174132c319252963b6%40%3Ccommits.directory.apache.org%3E · Note
• https://web.archive.org/web/20201209040832/http://securityfocus.com/archive/1/537225/100/0/threaded · Note
• https://t.me/cvenotify/18077 · Telegram Post
• http://securityfocus.com/archive/1/537225/100/0/threaded · Note
• https://lists.apache.org/thread.html/reb5443aaf781b364896ee9d7cf6e97fdc4f5a5174132c319252963b6@%3Ccommits.directory.apache.org%3E · Note