Vulnerability · Published Jan 10, 2022 · Assigned by Mend
CVE-2022-22121NocoDB - CSV Injection in User Management
High 8.0
In plain English
A high-severity security flaw in nocodb from nocodb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 70% of all known vulnerabilities).
Severity (CVSS 3.1)8.0High
Exploit odds (30 days)1.2%top 30.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection). A low privileged attacker can create a new table to inject payloads in the table rows. When an administrator accesses the User Management endpoint and exports the data as a CSV file and opens it, the payload gets executed.
Affected products (as reported)
Weakness: CWE-1236 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/nocodb/nocodb/commit/079e3abe x_refsource_MISC
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22121 x_refsource_MISC