p PatchFirst

CVE-2024-9102

CVE-2024-9102 · phpLDAPadmin: Improper Neutralization of Formula Elements

This page contains facts from public vulnerability sources. Check the original advisory before updating.

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection. NOTE: This vulnerability will not be addressed, the maintainer's position is that it is not the intention of phpLDAPadmin to control what data Administrators can put in their LDAP database, nor filter it on export.

CVSS 5.0 · Medium · EPSS 0.4%

Published
Updated

Stack: system

Affected products and versions

  • phpldapadmin

    Versions
    • 1.2.0: Affected
    • 1.2.6.7: Affected

    No fix published

  • phpldapadmin Debian:12

    Versions
    • 1.2.6.3-0.3
    • 1.2.6.3-0.3+deb12u1
    • 1.2.6.6-1
    • 1.2.6.6-2
    • 1.2.6.7-1
    • 1.2.6.7-2
    • 1.2.6.7-2~bpo12+1
    • 1.2.6.7-3
    • 1.2.6.7-3~bpo12+1
    • 1.2.6.7-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • phpldapadmin Debian:13

    Versions
    • 1.2.6.7-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • phpldapadmin Debian:14

    Versions
    • 1.2.6.7-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • phpldapadmin Ubuntu:16.04:LTS

    Versions
    • 1.2.2-5.2
    • 1.2.2-5.2ubuntu1
    • 1.2.2-5.2ubuntu2
    • 1.2.2-5.2ubuntu2.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • phpldapadmin Ubuntu:18.04:LTS

    Versions
    • 1.2.2-6ubuntu1
    • 1.2.2-6ubuntu1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • phpldapadmin Ubuntu:20.04:LTS

    Versions
    • 1.2.2-6.1ubuntu1
    • 1.2.2-6.2ubuntu1
    • 1.2.2-6.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • phpldapadmin Ubuntu:22.04:LTS

    Versions
    • 1.2.2-6.3
    • 1.2.6.3-0.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • phpldapadmin Ubuntu:24.04:LTS

    Versions
    • 1.2.6.3-0.3
    • 1.2.6.6-2
    • 1.2.6.7-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • phpldapadmin Ubuntu:25.10

    Versions
    • 1.2.6.7-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • phpldapadmin Ubuntu:26.10

    Versions
    • 1.2.6.7-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • phpldapadmin Ubuntu:26.04:LTS

    Versions
    • 1.2.6.7-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →