CVE-2021-40848
03.11.2021, 11:15
In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interpret as a command, leading to execution of a malicious string locally on a device, aka CSV injection.Enginsight
| Vendor | Product | Version |
|---|---|---|
| mahara | mahara | 𝑥 < 20.04.5 |
| mahara | mahara | 20.10.0 ≤ 𝑥 < 20.10.3 |
| mahara | mahara | 21.04.0 ≤ 𝑥 < 21.04.2 |
| mahara | mahara | 21.10.0:rc1 |
| mahara | mahara | 21.10.0:rc2 |
𝑥
= Vulnerable software versions