NN-2019:2-01

CSV Injection on node label

Last update: 2019-11-11

Advisory IDNN-2019:2-01
TopicCSV Injection on node label
ImpactNone
Issue date2019-11-11
AffectsN2OS <v19.0.4, Guardian and CMC
CVE Name(s)NA
CVSS Score8.0
CVE Risk LevelHigh
Risk Level for Nozomi customersMedium

Summary

CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. An authenticated malicious user can insert a crafted formula in the node label that can be later executed on another system after another user has downloaded and opened the node list export.

Affected Products

Guardian/CMC starting before v19.0.4 are affected.

Workarounds and Mitigations

Not required

Solutions

Upgrade to v19.0.4

Modification History

2019-11-11: Initial revision

Acknowledgements

Jonas Becker - Deloitte GmbH

Contact

Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com. More contact details on the PSIRT page.