CVE-2022-1544 HIGH

CVE-2022-1544: Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in luyadev/yii-helpers

Vendor Luyadev

Product luyadev/yii-helpers

Weakness CWE-1236

Published May 1, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

8.0/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data.

Key dates

02Disclosure timeline

May 1, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-1544 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1236.html

Related vulnerabilities

04Related CVE

CVE-2026-41073 RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps CVE-2022-3393 Post to CSV by BestWebSoft <= 1.4.0 - Author+ CSV Injection CVE-2021-37702 Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore CVE-2023-37219 Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV File CVE-2022-45357 WordPress 1003 Mortgage Application Plugin <= 1.75 is vulnerable to CSV Injection