UpHeron
All vulnerabilities

Servers and applications

CVE-2017-18049

In the CSV export feature of SilverStripe before 3.5.6, 3.6.x before 3.6.3, and 4.x before 4.0.1, it's possible for the output to contain macros and scripts, which may be executed if imported without sanitization into common software (including Microsoft Excel). For example, the CSV data may contain untrusted user input from the "First Name" field of a user's /myprofile page.

Severity
Medium 5.5
Published
23 Jan 2018
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
0.9% in the next 30 daysHigher than 60% of CVEs. EPSS by FIRST, 11 Nov 2026
Weakness
Injection (CWE-74)
Attack
Needs local access · No login needed · Needs someone to click or open something
Attacker can
Change data
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Sources
NVD

Affected software

SoftwareAffected versions
Silverstripe CMSServers and applications · cpe:a:silverstripe:silverstripe
  • Every version up to 3.5.5
  • From 3.6.0 up to 3.6.2
  • Version 4.0.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-18049
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-18049