title: CSV Injection in usage report downloaded from Pivotal Application Manager
description: Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can create an app with a name such that a csv program can interpret into a formula and gets executed. The malicious user can possibly gain access to a usage report that requires a higher privilege.
problem types: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
affected:
{
product: Apps Manager
vendor: Pivotal
versions:
lessThan: 670.0.7, status: affected, version: 670, versionType: custom
lessThan: 669.0.13, status: affected, version: 669, versionType: custom
lessThan: 668.0.21, status: affected, version: 668, versionType: custom
lessThan: 667.0.22, status: affected, version: 667, versionType: custom
lessThan: 666.0.36, status: affected, version: 666, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
version: 3.0
]