CVE-2015-5349

Published: Apr 11, 2016Modified: May 6, 2026

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow attackers to execute arbitrary commands by leveraging a crafted LDAP entry that is interpreted as a formula when imported into a spreadsheet.

Affected (27)

Products: Apache: Ldap Studio, Directory Studio

Apache

2 products

Ldap Studio

Directory Studio

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Apache Ldap Studio	Version 0.6.0
Apache Ldap Studio	Version 0.7.0
Apache Ldap Studio	Version 0.8.0
Apache Ldap Studio	Version 0.8.1

Configuration B

23 vulnerable

Vulnerable Software	Affected Versions
Apache Directory Studio	Version 1.0.0
Apache Directory Studio	Version 1.0.1
Apache Directory Studio	Version 1.1.0
Apache Directory Studio	Version 1.1.0 rc1
Apache Directory Studio	Version 1.1.0 rc2
Apache Directory Studio	Version 1.2.0
Apache Directory Studio	Version 1.2.0 rc1
Apache Directory Studio	Version 1.3.0
Apache Directory Studio	Version 1.3.0 rc1
Apache Directory Studio	Version 1.4.0
Apache Directory Studio	Version 1.5.0
Apache Directory Studio	Version 1.5.1
Apache Directory Studio	Version 1.5.2
Apache Directory Studio	Version 1.5.3
Apache Directory Studio	Version 2.0.0 milestone1
Apache Directory Studio	Version 2.0.0 milestone2
Apache Directory Studio	Version 2.0.0 milestone3
Apache Directory Studio	Version 2.0.0 milestone4
Apache Directory Studio	Version 2.0.0 milestone5
Apache Directory Studio	Version 2.0.0 milestone6
Apache Directory Studio	Version 2.0.0 milestone7
Apache Directory Studio	Version 2.0.0 milestone8
Apache Directory Studio	Version 2.0.0 milestone9