目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-1236 类漏洞列表 159

CWE-1236 类弱点 159 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-1236 属于 CSV 注入漏洞，指程序将用户输入写入 CSV 文件时未对特殊字符进行适当转义。攻击者利用此缺陷，在数据中嵌入以等号、加号或制表符开头的恶意公式，当受害者使用电子表格软件打开文件时，这些公式会被自动执行，可能导致数据泄露、远程代码执行或系统配置篡改。开发者应通过转义特殊字符、限制输入内容或采用非公式格式存储数据来防御此类攻击。

MITRE CWE 官方描述
CWE：CWE-1236 CSV 文件中公式元素的不当中和 英文：产品将用户提供的信息保存到逗号分隔值（Comma-Separated Value, CSV）文件中，但未对特殊元素进行中和，或中和不当，导致当文件被电子表格产品打开时，这些元素可能被解释为命令。
常见影响 (1)
Confidentiality Read Application Data, Execute Unauthorized Code or Commands
Attackers can populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software. Note that current versions of Excel warn users of untrusted content.
缓解措施 (3)
Implementation When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).
Effectiveness: Moderate
Implementation If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.
Effectiveness: Moderate
Architecture and Design Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.
Effectiveness: Limited
代码示例 (1)
Hyperlinks or other commands can be executed when a cell begins with the formula identifier, '='
=HYPERLINK(link_location, [friendly_name])
Attack · Other
HYPERLINK(link_location, [friendly_name])
Good · Other
CVE ID 标题 CVSS 风险等级 Published
CVE-2022-45078 WordPress Plugin User Blocker 安全漏洞 — User Blocker 5.9 Medium 2023-11-07
CVE-2022-45360 WordPress Plugin commenter-emails 安全漏洞 — Commenter Emails 4.7 Medium 2023-11-07
CVE-2022-45370 WordPress Plugin WordPress Comments Import & Export 安全漏洞 — WordPress Comments Import & Export 6.1 Medium 2023-11-07
CVE-2022-45348 WordPress Plugin amr-users 安全漏洞 — amr users 5.8 Medium 2023-11-07
CVE-2022-45810 WordPress Plugin Icegram Express 安全漏洞 — Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce 6.1 Medium 2023-11-07
CVE-2022-46821 WordPress Plugin jackmail-newsletters 安全漏洞 — Emails & Newsletters with Jackmail 5.8 Medium 2023-11-07
CVE-2022-46804 WordPress Plugin export-users-data-distinct 安全漏洞 — Export Users Data Distinct 5.8 Medium 2023-11-07
CVE-2022-46803 WordPress Plugin Simple Newsletter Plugin – Noptin 安全漏洞 — Simple Newsletter Plugin – Noptin 6.1 Medium 2023-11-07
CVE-2022-46809 WordPress Plugin ReviewX 安全漏洞 — ReviewX – Multi-criteria Rating & Reviews for WooCommerce 6.1 Medium 2023-11-07
CVE-2022-46801 WordPress Plugin Site Reviews 安全漏洞 — Site Reviews 6.1 Medium 2023-11-07
CVE-2022-46802 WordPress Plugin Product Reviews Import Export for WooCommerce 安全漏洞 — Product Reviews Import Export for WooCommerce 6.1 Medium 2023-11-07
CVE-2023-36527 WordPress Plugin Post to CSV by BestWebSoft 安全漏洞 — Post to CSV by BestWebSoft 4.7 Medium 2023-11-07
CVE-2023-23796 WordPress Plugin contact-form-add 安全漏洞 — Form Builder | Create Responsive Contact Forms 4.7 Medium 2023-11-07
CVE-2023-23678 WordPress Plugin WP Cookie Consent 安全漏洞 — WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) 4.0 Medium 2023-11-07
CVE-2022-45357 WordPress Plugin 1003 Mortgage Application 安全漏洞 — 1003 Mortgage Application 6.1 Medium 2023-11-07
CVE-2023-22719 WordPress Plugin GiveWP – Donation Plugin and Fundraising Platform 安全漏洞 — GiveWP 4.7 Medium 2023-11-07
CVE-2023-25983 WordPress Plugin KB Support – WordPress Help Desk and Knowledge Base 安全漏洞 — KB Support 7.1 - 2023-11-07
CVE-2022-47442 WordPress Plugin UsersWP 安全漏洞 — UsersWP 5.8 Medium 2023-11-07
CVE-2022-45350 WordPress Plugin Simple History 安全漏洞 — Simple History – user activity log, audit tool 3.0 Medium 2023-11-07
CVE-2023-43071 Dell SmartFabric Storage Software 安全漏洞 — Dell SmartFabric Storage Software 4.4 Medium 2023-10-05
CVE-2023-22877 IBM InfoSphere Information Server 安全漏洞 — InfoSphere Information Server 7.0 High 2023-08-28
CVE-2023-4006 phpMyFAQ 安全漏洞 — thorsten/phpmyfaq 8.8 - 2023-07-31
CVE-2023-37219 Tadiran Telecom Composit 安全漏洞 — Telecom Composit 7.3 High 2023-07-30
CVE-2023-3527 Avaya Call Management System 安全漏洞 — Avaya Call Management System 6.8 Medium 2023-07-18
CVE-2023-28958 IBM Cloud Pak for Data 安全漏洞 — Watson Knowledge Catalog on Cloud Pak for Data 7.0 High 2023-07-10
CVE-2023-3493 fossbilling 安全漏洞 — fossbilling/fossbilling 8.0 - 2023-06-30
CVE-2023-3302 Admidio 安全漏洞 — admidio/admidio 8.0 - 2023-06-23
CVE-2023-0721 WordPress和Elementor 安全漏洞 — MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor 8.3 High 2023-06-09
CVE-2023-2629 Pimcore 安全漏洞 — pimcore/customer-data-framework 8.0 - 2023-05-10
CVE-2023-2258 alf.io 安全漏洞 — alfio-event/alf.io 7.3 - 2023-04-24

CWE-1236 是常见的弱点类别，本平台收录该类弱点关联的 159 条 CVE 漏洞。