PT-2024-40381 · Microsoft · Office Excel

Published 2024-05-27 · Updated 2024-05-27

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CMS (affected versions not specified)

Description The issue concerns the CSV export feature of the CMS, where the output can contain macros and scripts. If these are imported into software like Microsoft Excel without proper sanitization, they may be executed. To mitigate this, the CMS will prepend potentially executable cell values exported from CSV with a literal tab character.

Recommendations For the CMS, consider updating the CSV export feature to prepend all potentially executable cell values with a literal tab character to prevent execution of macros and scripts when imported into other software.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

GHSA-MQJC-X563-C9Q8

Affected Products

Office Excel

References · 7

• https://osv.dev/vulnerability/GHSA-mqjc-x563-c9q8 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2017-007-1.yaml · Note
• https://github.com/silverstripe/silverstripe-framework/commit/cfe1d4f481bf53ea8da2b8608a563e207d923df9 · Note
• https://github.com/silverstripe/silverstripe-framework/commit/55739fa5af6171594b2cb4f3621d5fcce5e887d4 · Note
• https://github.com/silverstripe/silverstripe-framework/commit/dd4c5417e7592e29e698af428b72bdb9b6729797 · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://silverstripe.org/download/security-releases/ss-2017-007 · Note