CVE-2024-3232

Published: Jul 16, 2024Modified: Jun 17, 2026

6.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Exploitability: 0.9 / Impact: 5.9

Source: NVD

Description

A formula injection vulnerability exists in Tenable Identity Exposure where an authenticated remote attacker with administrative privileges could manipulate application form fields in order to trick another administrator into executing CSV payloads. - CVE-2024-3232

Affected (1)

Products: Tenable: Identity Exposure

1 product

Identity Exposure

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Tenable Identity Exposure	Before 3.59.4

Related CWEs

Improper Neutralization of Formula Elements in a CSV File

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

References (2)

https://www.tenable.com/security/tns-2024-04

Source: vulnreport@tenable.com

Vendor Advisory

https://www.tenable.com/security/tns-2024-04

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.