What is GHSA-2jvj-mhf2-g99w?

GHSA-2jvj-mhf2-g99w is a security advisory published by GitHub Security Advisories with Medium severity. SilverStripe CSV Excel Macro Injection

Which CVE IDs does GHSA-2jvj-mhf2-g99w cover?

GHSA-2jvj-mhf2-g99w covers the following CVE IDs: CVE-2017-18049. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2jvj-mhf2-g99w?

GHSA-2jvj-mhf2-g99w has a CVSS v3 base score of 5.5, published by GitHub Security Advisories.

Which products are affected by GHSA-2jvj-mhf2-g99w?

GHSA-2jvj-mhf2-g99w affects 3 products, including: composer/silverstripe/framework:\u003c 3.5.6; composer/silverstripe/framework:\u003e= 3.6.0, \u003c 3.6.3; composer/silverstripe/framework:\u003e= 4.0.0, \u003c 4.0.1.

GHSA-2jvj-mhf2-g99wMediumCVSS 5.5

SilverStripe CSV Excel Macro Injection

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

April 25, 2024

🔗 CVE IDs covered (1)

CVE-2017-18049 →

📋 Description

In the CSV export feature of SilverStripe before 3.5.6, 3.6.x before 3.6.3, and 4.x before 4.0.1, it's possible for the output to contain macros and scripts, which may be executed if imported without sanitization into common software (including Microsoft Excel). For example, the CSV data may contain untrusted user input from the "First Name" field of a user's /myprofile page.

🎯 Affected products3

composer/silverstripe/framework:< 3.5.6
composer/silverstripe/framework:>= 3.6.0, < 3.6.3
composer/silverstripe/framework:>= 4.0.0, < 4.0.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2017-18049
https://www.silverstripe.org/download/security-releases/ss-2017-007
https://www.exploit-db.com/exploits/43396
https://github.com/advisories/GHSA-2jvj-mhf2-g99w