CVE-2022-22689

Published: Feb 4, 2022Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

CA Harvest Software Change Manager versions 13.0.3, 13.0.4, 14.0.0, and 14.0.1, contain a vulnerability in the CSV export functionality, due to insufficient input validation, that can allow a privileged user to potentially execute arbitrary code or commands.

Affected (4)

Products: Broadcom: Ca Harvest Software Change Manager

Broadcom

1 product

Ca Harvest Software Change Manager

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Broadcom Ca Harvest Software Change Manager	Version 13.0.3
Broadcom Ca Harvest Software Change Manager	Version 13.0.4
Broadcom Ca Harvest Software Change Manager	Version 14.0.0
Broadcom Ca Harvest Software Change Manager	Version 14.0.1

Related CWEs

CWE-1236

Improper Neutralization of Formula Elements in a CSV File

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

References (2)

https://support.broadcom.com/security-advisory/content/security-advisories/CA20220203-01-Security-Notice-for-CA-Harvest-Software-Change-Manager/ESDSA20297

Source: vuln@ca.com

PatchVendor Advisory

https://support.broadcom.com/security-advisory/content/security-advisories/CA20220203-01-Security-Notice-for-CA-Harvest-Software-Change-Manager/ESDSA20297

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.