Lucene search

MendCVELIST:CVE-2022-22121

HistoryJan 10, 2022 - 3:25 p.m.

CVE-2022-22121 NocoDB - CSV Injection in User Management

2022-01-1015:25:28

CWE-1236

Mend

www.cve.org

nocodb

csv injection

user management

vulnerability

administrator access

payloads

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

40.5%

JSON

In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection). A low privileged attacker can create a new table to inject payloads in the table rows. When an administrator accesses the User Management endpoint and exports the data as a CSV file and opens it, the payload gets executed.

CNA Affected

[
  {
    "product": "nocodb",
    "vendor": "nocodb",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "0.81.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "0.83.8",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/nocodb/nocodb/commit/079e3abe

www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22121

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

40.5%

JSON

Related for CVELIST:CVE-2022-22121