Log in Start free

Vulnerability · Published Dec 19, 2024 · Assigned by NCSC.ch

CVE-2024-9102phpLDAPadmin: Improper Neutralization of Formula Elements

Medium 5.0

In plain English

A medium-severity security flaw in phpLDAPadmin from phpLDAPadmin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 4.0)5.0Medium
Exploit odds (30 days)0.4%top 63.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection. NOTE: This vulnerability will not be addressed, the maintainer's position is that it is not the intention of phpLDAPadmin to control what data Administrators can put in their LDAP database, nor filter it on export.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12phpldapadminno fix listedDEBIAN-CVE-2024-9102
Debian:13phpldapadminno fix listedDEBIAN-CVE-2024-9102
Debian:14phpldapadminno fix listedDEBIAN-CVE-2024-9102
Ubuntu:22.04:LTSphpldapadminno fix listedUBUNTU-CVE-2024-9102
Ubuntu:24.04:LTSphpldapadminno fix listedUBUNTU-CVE-2024-9102
Ubuntu:25.10phpldapadminno fix listedUBUNTU-CVE-2024-9102
Ubuntu:26.04:LTSphpldapadminno fix listedUBUNTU-CVE-2024-9102
Ubuntu:26.10phpldapadminno fix listedUBUNTU-CVE-2024-9102

Affected products (as reported)

VendorProductVersions
phpLDAPadmin phpLDAPadmin 1.2.01.2.6.7

Weakness: CWE-1236 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:L

References