GHSA-H7VQ-5QGW-JWWQ高危已审查

CSV Injection Vulnerability

OSV 1.4.0 · github-reviewed · 修改于 2021-10-19 03:11

发布时间

2021-10-19 03:04

GitHub 审查时间

2021-10-16 01:36

NVD 发布时间

2021-09-30 08:15

源文件

advisories/github-reviewed/2021/10/GHSA-h7vq-5qgw-jwwq/GHSA-h7vq-5qgw-jwwq.json

公告说明

Impact

In some circumstances, it was possible to export data in CSV format that could trigger a payload in old versions of Excel.

If you are accepting user input from untrusted sources and will be exporting that data in CSV format from element index pages and there is a chance users will open that on old versions of Excel, then you should update.

Patches

This has been patched in Craft 3.7.14.

References

For more information

If you have any questions or comments about this advisory, email us at [email protected]

Credits: BAE Systems AI Vulnerability Research Team – Azrul Ikhwan Zulkifli

受影响的软件包

Packagist

标识信息

别名 / CVE

CVE-2021-41824

CWE

CWE-1236

软件生态

Packagist

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

原始 OSV JSON

{
  "id": "GHSA-h7vq-5qgw-jwwq",
  "aliases": [
    "CVE-2021-41824"
  ],
  "details": "### Impact\nIn some circumstances, it was possible to export data in CSV format that could trigger a payload in old versions of Excel.\n\nIf you are accepting user input from untrusted sources and will be exporting that data in CSV format from element index pages and there is a chance users will open that on old versions of Excel, then you should update.\n\n### Patches\nThis has been patched in Craft 3.7.14.\n\n### References\n* https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3714---2021-09-28\n* https://twitter.com/craftcmsupdates/status/1442928690145366018\n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at [email protected]\n\n----------\n\nCredits: BAE Systems AI Vulnerability Research Team – Azrul Ikhwan Zulkifli",
  "summary": "CSV Injection Vulnerability",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "3.4.0"
            },
            {
              "fixed": "3.7.14"
            }
          ]
        }
      ],
      "package": {
        "name": "craftcms/cms",
        "ecosystem": "Packagist"
      }
    }
  ],
  "modified": "2021-10-18T19:11:00Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
  "published": "2021-10-18T19:04:16Z",
  "references": [
    {
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-h7vq-5qgw-jwwq",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41824",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/craftcms/cms/commit/c9cb2225f1b908fb1e8401d401219228634b26b2",
      "type": "WEB"
    },
    {
      "url": "https://github.com/craftcms/cms",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3714---2021-09-28",
      "type": "WEB"
    },
    {
      "url": "https://twitter.com/craftcmsupdates/status/1442928690145366018",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-1236"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": "2021-09-30T00:15:00Z",
    "github_reviewed_at": "2021-10-15T17:36:16Z"
  }
}