CVE-2018-15474

State: Published
Severity: Not scored
Published: Sep 7, 2018
Updated: Aug 5, 2024
Reserved: Aug 17, 2018

Description

CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins/usermanager/admin.php in DokuWiki 2018-04-22a and earlier allows remote attackers to exfiltrate sensitive data and to execute arbitrary code via a value that is mishandled in a CSV export. NOTE: the vendor has stated "this is not a security problem in DokuWiki.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://github.com/splitbrain/dokuwiki/issues/2450
https://www.sec-consult.com/en/blog/advisories/dokuwiki-csv-formula-injection-vulnerability/
20180906 SEC Consult SA-20180906-0 :: CSV Formula Injection in DokuWikimailing-list
https://www.patreon.com/posts/unfixed-security-21250652

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.