Every CVE Search/ Get API key

CVE-2024-9102

phpLDAPadmin: Improper Neutralization of Formula Elements

5.0 MediumDisputed

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection. NOTE: This vulnerability will not be addressed, the maintainer's position is that it is not the intention of phpLDAPadmin to control what data Administrators can put in their LDAP database, nor filter it on export.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.42%Up 0.4 points since Dec 20, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.0

phpLDAPadmin: Improper Neutralization of Formula Elements

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection. NOTE: This vulnerability will not be addressed, the maintainer's position is that it is not the intention of phpLDAPadmin to control what data Administrators can put in their LDAP database, nor filter it on export.

Record
CVE-2024-9102
CVSS 4.0
5.0 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:L
Weakness
CWE-1236
Updated
2026-11-02
EUVDEUVD-2024-50429 5.0

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection. NOTE: This vulnerability will not be addressed, the maintainer's position is that it is not the intention of phpLDAPadmin to control what data Administrators can put in their LDAP database, nor filter it on export.

Record
EUVD-2024-50429
CVSS 4.0
5.0 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-p8hv-f2qg-cxvv 5.0

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to...

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection.

Record
GHSA-p8hv-f2qg-cxvv
CVSS 4.0
5.0 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-1236
Updated
2026-11-02
NVD 5.0

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection. NOTE: This vulnerability will not be addressed, the maintainer's position is that it is not the intention of phpLDAPadmin to control what data Administrators can put in their LDAP database, nor filter it on export.

Record
CVE-2024-9102
CVSS 4.0
5.0 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-1236
Updated
2026-11-02
OSV 5.0

phpLDAPadmin: Improper Neutralization of Formula Elements

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection. NOTE: This vulnerability will not be addressed, the maintainer's position is that it is not the intention of phpLDAPadmin to control what data Administrators can put in their LDAP database, nor filter it on export.

Record
CVE-2024-9102
CVSS 4.0
5.0 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:L
Weakness
CWE-1236
Updated
2026-11-02
OSVDEBIAN-CVE-2024-9102 5.0

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection. NOTE: This vulnerability will not be addressed, the maintainer's position is that it is not the intention of phpLDAPadmin to control what data Administrators can put in their LDAP database, nor filter it on export.

Record
DEBIAN-CVE-2024-9102
CVSS 4.0
5.0 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2024-9102 5.0

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection. NOTE: This vulnerability will not be addressed, the maintainer's position is that it is not the intention of phpLDAPadmin to control what data Administrators can put in their LDAP database, nor filter it on export.

Record
UBUNTU-CVE-2024-9102
CVSS 4.0
5.0 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:L
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
phpldapadmin
Debian:12
 All versions, plus listed versions
1.2.6.3-0.31.2.6.3-0.3+deb12u11.2.6.6-11.2.6.6-21.2.6.7-1
Show 5 moreShow less
1.2.6.7-21.2.6.7-2~bpo12+11.2.6.7-31.2.6.7-3~bpo12+11.2.6.7-4
 None known
phpldapadmin
Debian:13
 All versions, plus listed versions
1.2.6.7-4
 None known
phpldapadmin
Debian:14
 All versions, plus listed versions
1.2.6.7-4
 None known
phpldapadmin
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.2.2-5.21.2.2-5.2ubuntu11.2.2-5.2ubuntu21.2.2-5.2ubuntu2.1
 None known
phpldapadmin
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.2.2-6ubuntu11.2.2-6ubuntu1.1
 None known
phpldapadmin
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.2.2-6.1ubuntu11.2.2-6.2ubuntu11.2.2-6.3
 None known
phpldapadmin
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.2.2-6.31.2.6.3-0.2
 None known
phpldapadmin
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.2.6.3-0.31.2.6.6-21.2.6.7-1
 None known
phpldapadmin
Ubuntu:25.10
 All versions, plus listed versions
1.2.6.7-4
 None known
phpldapadmin
Ubuntu:26.10
 All versions, plus listed versions
1.2.6.7-4
 None known
phpldapadmin
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.2.6.7-4
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-9102 is a medium vulnerability (CVSS 5.0) in Phpldapadmin, published December 19, 2024. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile.

References

Show 6 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open