Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Apache LDAP Studio and Apache Directory Studio CSV Export Allows Malicious LDAP Import

CVE-2015-5349 · published 10 years ago
Summary

Apache LDAP Studio and Apache Directory Studio versions prior to 2.0.0-M10 contain a security issue where exporting data to a CSV file does not properly protect against malicious LDAP data. This could allow an attacker to trick a user into executing malicious commands when importing the affected data into a spreadsheet. Update to version 2.0.0-M10 or later to fix this issue.

What to do
  • Update apache org.apache.directory.studio:org.apache.directory.studio.ldapbrowser.core to version 2.0.0.v20151221-M10.
Affected software
Ecosystem VendorProductAffected versions
maven apache org.apache.directory.studio:org.apache.directory.studio.ldapbrowser.core < 2.0.0.v20151221-M10
Fix: upgrade to 2.0.0.v20151221-M10
– apache ldap_studio 0.6.0
0.7.0
0.8.0
0.8.1
cpe:2.3:a:apache:ldap_studio:0.6.0:*:*:*:*:*:*:*
– apache directory_studio 1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
cpe:2.3:a:apache:directory_studio:1.0.0:*:*:*:*:*:*:*
Original advisory text
The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow attackers to execute arbitrary commands by leveraging a cr...
The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow attackers to execute arbitrary commands by leveraging a crafted LDAP entry that is interpreted as a formula when imported into a spreadsheet.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.8 High
Exploitation
2% chance of attack within 30 days
Type
CWE-77Command Injection
Timeline
Published11 Apr 2016
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-p9qj-4rjp-j3w9 · GHSA
CVE-2015-5349 · NVD
Track software like this
Free during beta