CVE-2024-41226

Katalog CVE

CVSS 7.8 · High EPSS 0,57%

Kerentanan Improper Neutralization of Formula Elements in a CSV File pada automationanywhere automation 360. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A CSV injection vulnerability in Automation Anywhere Automation 360 version 21094 allows attackers to execute arbitrary code via a crafted payload. NOTE: Automation Anywhere disputes this report, arguing the attacker executes everything from the client side and does not attack the Control Room. The payload is being injected in the http Response from the client-side, so the owner of the Response and payload is the end user in this case. They contend that the server's security controls have no impact or role to play in this situation and therefore this is not a valid vulnerability.

Rincian

Terbit di NVD

6 Agustus 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1236: Improper Neutralization of Formula Elements in a CSV File

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://medium.com/%40aksalsalimi/cve-2024-41226-response-manipulation-led-to-csv-injection-9ae3182dcc02 exploit · advisory pihak ketiga
• https://www.automationanywhere.com/products/automation-360 product