CVE-2015-5349 Apache Directory Studio Command Injection
HighCVSS 7.8
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow attackers to execute arbitrary commands by leveraging a crafted LDAP entry that is interpreted as a formula when imported into a spreadsheet.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.directory.studio/org.apache.directory.studio.ldapbrowser.core(Maven) | < 2.0.0.v20151221-M10 | 2.0.0.v20151221-M10 |
| org.apache.directory.studio/org.apache.directory.studio.ldapbrowser.core(Maven) | = 2.0.0.v20150606-M9 | No fix listed |
| apache ldap studio | = 0.6.0 | No fix listed |
| apache ldap studio | = 0.7.0 | No fix listed |
| apache ldap studio | = 0.8.0 | No fix listed |
| apache ldap studio | = 0.8.1 | No fix listed |
| apache directory studio | = 1.0.0 | No fix listed |
| apache directory studio | = 1.0.1 | No fix listed |
| apache directory studio | = 1.1.0 | No fix listed |
| apache directory studio | = 1.1.0-rc1 | No fix listed |
| apache directory studio | = 1.1.0-rc2 | No fix listed |
| apache directory studio | = 1.2.0 | No fix listed |
| apache directory studio | = 1.2.0-rc1 | No fix listed |
| apache directory studio | = 1.3.0 | No fix listed |
| apache directory studio | = 1.3.0-rc1 | No fix listed |
| apache directory studio | = 1.4.0 | No fix listed |
| apache directory studio | = 1.5.0 | No fix listed |
| apache directory studio | = 1.5.1 | No fix listed |
| apache directory studio | = 1.5.2 | No fix listed |
| apache directory studio | = 1.5.3 | No fix listed |
| apache directory studio | = 2.0.0-milestone1 | No fix listed |
| apache directory studio | = 2.0.0-milestone2 | No fix listed |
| apache directory studio | = 2.0.0-milestone3 | No fix listed |
| apache directory studio | = 2.0.0-milestone4 | No fix listed |
| apache directory studio | = 2.0.0-milestone5 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache directory studio | = 2.0.0-milestone6 | No fix listed |
| apache directory studio | = 2.0.0-milestone7 | No fix listed |
| apache directory studio | = 2.0.0-milestone8 | No fix listed |
| apache directory studio | = 2.0.0-milestone9 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- directory.apache.org vendor-advisory
- lists.apache.org
- github.com patch
- web.archive.org
- github.com
- github.com product
- 20160102 [SECURITY] CVE-2015-5349: Apache Directory Studio command injection vulnerability mailing-list
- [directory-commits] 20210724 [directory-site] branch master updated: Publish CVE-2021-33900 mailing-list
- Debian Security Tracker CVE-2015-5349 vendor-advisory