目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-1236 类漏洞列表 159

CWE-1236 类弱点 159 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-1236 属于 CSV 注入漏洞，指程序将用户输入写入 CSV 文件时未对特殊字符进行适当转义。攻击者利用此缺陷，在数据中嵌入以等号、加号或制表符开头的恶意公式，当受害者使用电子表格软件打开文件时，这些公式会被自动执行，可能导致数据泄露、远程代码执行或系统配置篡改。开发者应通过转义特殊字符、限制输入内容或采用非公式格式存储数据来防御此类攻击。

MITRE CWE 官方描述
CWE：CWE-1236 CSV 文件中公式元素的不当中和 英文：产品将用户提供的信息保存到逗号分隔值（Comma-Separated Value, CSV）文件中，但未对特殊元素进行中和，或中和不当，导致当文件被电子表格产品打开时，这些元素可能被解释为命令。
常见影响 (1)
Confidentiality Read Application Data, Execute Unauthorized Code or Commands
Attackers can populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software. Note that current versions of Excel warn users of untrusted content.
缓解措施 (3)
Implementation When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).
Effectiveness: Moderate
Implementation If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.
Effectiveness: Moderate
Architecture and Design Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.
Effectiveness: Limited
代码示例 (1)
Hyperlinks or other commands can be executed when a cell begins with the formula identifier, '='
=HYPERLINK(link_location, [friendly_name])
Attack · Other
HYPERLINK(link_location, [friendly_name])
Good · Other
CVE ID 标题 CVSS 风险等级 Published
CVE-2023-29109 SAP Application Interface Framework 安全漏洞 — Application Interface Framework (Message Dashboard) 4.4 Medium 2023-04-11
CVE-2023-25611 Fortinet FortiAnalyzer 安全漏洞 — FortiAnalyzer 4.0 Medium 2023-03-07
CVE-2022-35281 IBM Maximo Asset Management 安全漏洞 — Maximo Asset Management 5.5 Medium 2023-01-06
CVE-2022-4034 WordPress plugin Appointment Hour Booking 安全漏洞 — Appointment Hour Booking – Booking Calendar 5.8 Medium 2022-11-29
CVE-2022-41675 Team Johnlong software Raiden MAILD Mail Server 安全漏洞 — MAILD Mail Server 8.0 High 2022-11-29
CVE-2022-3574 WordPress plugin WPForms Pro 安全漏洞 — WPForms Pro 9.8 - 2022-11-14
CVE-2022-27858 WordPress plugin Activity Log 注入漏洞 — Activity Log (WordPress plugin) 7.4 High 2022-11-08
CVE-2022-3463 WordPress plugin Contact Form Plugin 安全漏洞 — Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms 8.8 - 2022-11-07
CVE-2022-3558 WordPress plugin Import and export users and customers 安全漏洞 — Import and export users and customers 8.0 - 2022-11-07
CVE-2022-40294 PHP Point of Sale 安全漏洞 — PHP Point of Sale 8.8 - 2022-10-31
CVE-2022-3393 WordPress plugin Post to CSV by BestWebSoft 安全漏洞 — Post to CSV by BestWebSoft 8.8 - 2022-10-25
CVE-2022-2798 WordPress plugin Affiliates Manager 安全漏洞 — Affiliates Manager 8.0 - 2022-09-16
CVE-2022-1194 WordPress plugin Mobile Events Manager 安全漏洞 — Mobile Events Manager 8.0 - 2022-09-16
CVE-2022-3026 WordPress plugin WP Users Exporter 安全漏洞 — WP Users Exporter 6.5 Medium 2022-09-06
CVE-2022-2240 WordPress plugin Request a Quote 跨站脚本漏洞 — Request a Quote 8.8 - 2022-07-25
CVE-2022-1539 WordPress plugin Exports and Reports 安全漏洞 — Exports and Reports 8.8 - 2022-07-25
CVE-2022-2112 InvenTree 安全漏洞 — inventree/inventree 8.8 - 2022-06-17
CVE-2022-1202 WordPress plugin WP-CRM 安全漏洞 — WP-CRM – Customer Relations Management for WordPress 7.8 - 2022-06-13
CVE-2022-2027 titra 安全漏洞 — kromitgmbh/titra 8.8 - 2022-06-08
CVE-2022-26867 Dell EMC PowerStore 安全漏洞 — PowerStore 5.9 Medium 2022-06-02
CVE-2022-1544 yii-helpers 安全漏洞 — luyadev/yii-helpers 7.8 - 2022-05-01
CVE-2021-23286 Eaton Intelligent Power Manager 安全漏洞 — Intelligent Power Manager Infrastructure (IPM Infrastructure) 5.7 Medium 2022-04-18
CVE-2022-0142 WordPress plugin Visual Form Builder 信息泄露漏洞 — Visual Form Builder 9.8 - 2022-04-12
CVE-2022-24770 Gradio 安全漏洞 — gradio 8.8 High 2022-03-17
CVE-2022-22689 CA Harvest Software Change Manager 安全漏洞 — CA Harvest Software Change Manager 8.8 - 2022-02-04
CVE-2022-22121 NocoDB 安全漏洞 — nocodb 8.0 High 2022-01-10
CVE-2021-41270 Sensio Labs Symfony 安全漏洞 — symfony 6.5 Medium 2021-11-24
CVE-2021-38424 Delta Electronics DiaLink 安全漏洞 — DIALink 5.9 Medium 2021-11-03
CVE-2020-36503 WordPress 安全漏洞 — Connections Business Directory 8.0 - 2021-11-01
CVE-2021-38180 SAP Business One 安全漏洞 — SAP Business One 8.8 - 2021-10-12

CWE-1236 是常见的弱点类别，本平台收录该类弱点关联的 159 条 CVE 漏洞。