CVE-2023-3527
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data. When exported to a CSV file, this data may attempt arbitrary command execution on the system used to open the file by spreadsheet software such as Microsoft Excel.
Risk Assessment
This vulnerability poses a risk of unauthorized command execution on users' systems, potentially leading to serious data and system security breaches for the organization.
Recommendation
It is recommended to restrict access to the CSV export functionality to trusted users and implement data validation filters for inputs made by administrators.
Original NVD description (English source)
A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a spreadsheet software such as Microsoft Excel.