PT-2020-10218 · Microsoft+1 · Office Excel+1

Published 2020-03-18 · Updated 2020-08-24 · CVE-2019-19676

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions arxes-tolina version 3.0.0

Description A CSV injection issue allows malicious users to gain remote control of other computers by entering formula code in specific columns, including Kundennummer, Firma, Street, PLZ, Ort, Zahlziel, and Bemerkung. This can lead to the creation of a user with a name containing malicious code. If other users download the corrupted data as a CSV file and open it in a tool like Microsoft Excel, their PC can be compromised, potentially granting the attacker remote access.

Recommendations For arxes-tolina version 3.0.0, consider restricting access to the columns Kundennummer, Firma, Street, PLZ, Ort, Zahlziel, and Bemerkung to prevent malicious formula code injection until a patch is available. As a temporary workaround, avoid downloading and opening CSV files from untrusted sources in tools like Microsoft Excel to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2019-19676

Affected Products

Office Excel

Arxes-Tolina

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-19676 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19676 · Vendor Advisory
• https://t.me/cvenotify/1888 · Telegram Post
• https://www2.deloitte.com/de/de/pages/risk/articles/arxes-tolina-csv-injection.html · Note