CVE-2023-35899
HIGHDescription
IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 259354.
Is your site exposed to CVE-2023-35899?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
| ibm | cloud_pak_for_business_automation |
References
Frequently Asked Questions
What is CVE-2023-35899? +
How severe is CVE-2023-35899? +
What products are affected by CVE-2023-35899? +
How do I check if I'm vulnerable to CVE-2023-35899? +
Related Vulnerabilities
In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation …
Data provided in a request performed to the server while activating a new device are put in a database. Other …
phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory …
There is a CSV injection vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could build malicious data …
KWHotel 0.47 is vulnerable to CSV Formula Injection in the add guest function.
A CSV injection vulnerability in the /id_profiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplying …