CVE-2022-38844

Published Sep 16, 2022

Last updated 2 years ago

Overview

Description: CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands. Admin user exporting contacts in CSV file may end up executing the malicious system commands on his system.
Source: cve@mitre.org
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 8
Impact score: 5.9
Exploitability score: 2.1
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-1236

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:espocrm:espocrm:7.1.8:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D43B363E-F815-45B5-9012-8DA44D92F0FC"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References