CVE-2021-38180

Katalog CVE

CVSS 9.8 · Critical EPSS 2,1%

Kerentanan Improper Neutralization of Formula Elements in a CSV File pada sap business one. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitation during the data export. An attacker could thereby execute arbitrary commands on the victim's computer but only if the victim allows to execute macros while opening the file and the security settings of Excel allow for command execution.

Rincian

Terbit di NVD

12 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1236: Improper Neutralization of Formula Elements in a CSV File

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 80,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983 advisory vendor
• https://launchpad.support.sap.com/#/notes/3079427 permissions required