title: Ericsson Network Manager - Improper Neutralization of Formula Elements Vulnerability
description:
Ericsson Network Manager (ENM), versions prior to 23.1, contains a vulnerability in the export function of application log where Improper Neutralization of Formula Elements in a CSV File can lead to code execution or information disclosure. There is limited impact to integrity and availability. The attacker on the adjacent network with administration access can exploit the vulnerability.
problem types: CWE-1236 Improper Neutralization of Formula Elements in a CSV File
affected:
{
defaultStatus: unaffected
product: Ericsson Network Manager
vendor: Ericsson
versions:
lessThan: 23.1, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Upgrade to ENM version 23.1 or later.