Back

CVE-2021-38963

Sept. 25, 2024, 1:15 a.m.

Received
CVE has been recently published to the CVE List and has been received by the NVD.

Products

IBM Aspera Console

  • 3.4.0
  • 3.4.1
  • 3.4.2
  • 3.4.3
  • 3.4.4

Source

psirt@us.ibm.com

Tags

psirt@us.ibm.com
CWE-1236
2024-09-25
CVE-2021-38963

CVE-2021-38963 details

Published : Sept. 25, 2024, 1:15 a.m.
Last Modified : Sept. 25, 2024, 1:15 a.m.

Description

IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a CSV injection vulnerability. By persuading a victim to open a specially crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVSS Score

1 2 3 4 5 6 7 8.0 9 10

Weakness

Weakness Name Description
CWE-1236 Improper Neutralization of Formula Elements in a CSV File The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

8.0

Exploitability Score

2.1

Impact Score

5.9

Base Severity

HIGH

Vector String : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

URL Source
https://www.ibm.com/support/pages/node/7169765 psirt@us.ibm.com
This website uses the NVD API, but is not approved or certified by it.