CVE-2021-38180

State: Published
Severity: Not scored
Published: Oct 12, 2021
Updated: Aug 4, 2024
Reserved: Aug 7, 2021

Description

SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitation during the data export. An attacker could thereby execute arbitrary commands on the victim's computer but only if the victim allows to execute macros while opening the file and the security settings of Excel allow for command execution.

Scores

The record has no CVSS score.

Weaknesses

CWE-1236

Affected Products

Product	Versions
SAP Business OneSAP SE	< 10.0Affected

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983
https://launchpad.support.sap.com/#/notes/3079427

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.