What is CVE-2018-20468?

CVE-2018-20468 is a high-severity vulnerability in Sahipro Sahi Pro, classified under Improper Neutralization of Formula Elements in a CSV File. CVSS score: 8.8/10. Published 2019-06-17.

How severe is CVE-2018-20468?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Sahipro Sahi Pro

CVE-2018-20468

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A web reports module has "export to excel features" that are vulnerable to CSV injection. An attacker can embed Excel formulas inside an automation script that, when exported after execution, results in code execution.

EPSS: 0.022 (80.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Sahipro Sahi_pro
N/a — versions n/a

Weakness classification (CWE)

CWE-1236 — Improper Neutralization of Formula Elements in a CSV File

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-20468?: CVE-2018-20468 is a high-severity vulnerability in Sahipro Sahi Pro, classified under Improper Neutralization of Formula Elements in a CSV File. CVSS score: 8.8/10. Published 2019-06-17.
How severe is CVE-2018-20468?: High severity. CVSS v3 base score is 8.8 out of 10.