CVE catalog

CVE-2024-9102

phpldapadmin: CVE-2024-9102

[CVE catalog]

Severity
Low
Published
Source
[NVD] · [CVE record]
EPSS
0.42% · Oct 25, 2026

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection. NOTE: This vulnerability will not be addressed, the maintainer's position is that it is not the intention of phpLDAPadmin to control what data Administrators can put in their LDAP database, nor filter it on export.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianphpldapadminsid1.2.6.7-4vulnerable
Debianphpldapadminforky1.2.6.7-4vulnerable
Debianphpldapadmintrixie1.2.6.7-4vulnerable
Debianphpldapadminbookworm1.2.6.3-0.3+deb12u1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianphpldapadminsourcesid(unfixed)unimportantNot reported[1090914]
Debianphpldapadminsourceforky(unfixed)unimportantNot reported[1090914]
Debianphpldapadminsourcetrixie(unfixed)unimportantNot reported[1090914]
Debianphpldapadminsourcebookworm(unfixed)unimportantNot reported[1090914]

[Debian bug #1090914]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [phpldapadmin]Affected
    Details (4)

    • 1.2.6.3-0.3+deb12u1 · all · bookworm

      Affected

      dsa · phpldapadmin · debian · bookworm; dsa · phpldapadmin · debian · 12

    • 1.2.6.3-0.3+deb12u1 · all · bookworm

      Affected

      dsa · phpldapadmin · debian · bookworm; dsa · phpldapadmin · debian · 12

    • 1.2.6.7-3~bpo12+1 · all · bookworm-backports

      Affected

      dsa · phpldapadmin · debian · bookworm; dsa · phpldapadmin · debian · 12

    • 1.2.6.7-3~bpo12+1 · all · bookworm-backports

      Affected

      dsa · phpldapadmin · debian · bookworm; dsa · phpldapadmin · debian · 12

[Debian 13 (Trixie)]

  • [phpldapadmin]Affected
    Details (2)

    • 1.2.6.7-4 · all · trixie

      Affected

      dsa · phpldapadmin · debian · 13

    • 1.2.6.7-4 · all · trixie

      Affected

      dsa · phpldapadmin · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]