CVE-2022-26867
Assigner: dell
Published: 2022-04-19T00:00:00
State: PUBLISHED
affected: product: PowerStore
vendor: Dell
versions: lessThan: PowerStore SW v2.1.1.0
status: affected
version: unspecified
versionType: custom
datePublic: 2022-04-19T00:00:00
descriptions: value: PowerStore SW v2.1.1.0 supports the option to export data to either a CSV or an XLSX file. The data is taken as is, without any validation or sanitization. It allows a malicious, authenticated user to inject payloads that might get interpreted as formulas by the corresponding spreadsheet application that is being used to open the CSV/XLSX file.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
problemTypes: descriptions: cweId: CWE-1236
description: CWE-1236: Improper Neutralization of Formula Elements in a CSV File
type: CWE