CVE-2019-12134

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in Workday through 32 via a value (provided by a low-privileged user in a contact form field) that is mishandled in a CSV export.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 64%
VendorProductVersion
workdayworkday
𝑥
≤ 32.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://sinfosec757.blogspot.com/2019/06/exploit-title-workday-32-csv-injection.html
https://sinfosec757.blogspot.com/2019/06/exploit-title-workday-32-csv-injection.html