← Back

CVE-2024-25007

nvd nist
Published: Apr 4, 2024Modified: Jun 17, 2026

JSON object

Loading...
7.1
Vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L
Exploitability: 1.2 / Impact: 5.3
Source: NVD

Description

Ericsson Network Manager (ENM), versions prior to 23.1, contains a vulnerability in the export function of application log where Improper Neutralization of Formula Elements in a CSV File can lead to code execution or information disclosure. There is limited impact to integrity and availability. The attacker on the adjacent network with administration access can exploit the vulnerability.

Affected (1)

Ericsson
1 product
Network Manager
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Network Manager
Before 23.1

Related CWEs

CWE-1236
Improper Neutralization of Formula Elements in a CSV File
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

References (2)

Source: 85b1779b-6ecd-4f52-bcc5-73eac4659dcf
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.