CVE-2024-9102

MEDIUM EPSS 32.6%
Published Dec 19, 20241y ago · Modified Jun 17, 20262w ago
5.0 CVSS 4.0
Medium
Find Similar
Published Dec 19, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection. NOTE: This vulnerability will not be addressed, the maintainer's position is that it is not the intention of phpLDAPadmin to control what data Administrators can put in their LDAP database, nor filter it on export.

CVSS Details

Base Score
5.0
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
32.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-1236

References 4

  • github.com https://github.com/leenooks/phpLDAPadmin/commit/ea17aadef46fd29850160987fe7740ceed1381ad#diff-93b9f3e6d4c5bdacf469ea0ec74c1e9217ca6272da9be5a1bfd711f7da16f9e3R240
  • github.com https://github.com/leenooks/phpLDAPadmin/issues/274#issuecomment-2586859072
  • sourceforge.net https://sourceforge.net/projects/phpldapadmin/files/phpldapadmin-php5/1.2.0
  • redguard.ch https://www.redguard.ch/blog/2024/12/19/security-advisory-phpldapadmin/

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.