Rosariosis CVE-2023-29918

MEDIUM

Improper Neutralization of Formula Elements in a CSV File (CWE-1236)

2023-05-02 cve@mitre.org

Code Injection Rosariosis

5.4

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

1

CVE Published

May 02, 2023 - 16:15 nvd

MEDIUM 5.4

DescriptionNVD

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.

AnalysisAI

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-1236. RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module. Affected products include: Rosariosis.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Rosariosis

View all

CVE-2021-44427 CRITICAL Act Now POC

An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allow

CVE-2022-2067 CRITICAL Act Now POC

SQL Injection in GitHub repository francoisjacquet/rosariosis prior to 9.0. Rated critical severity (CVSS 9.1), this vul

CVE-2023-0994 HIGH This Week POC

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8

CVE-2021-45416 MEDIUM This Month POC

Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the

CVE-2020-15718 MEDIUM This Month POC

RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php sc

CVE-2020-15716 MEDIUM This Month POC

RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php scrip

CVE-2022-2714 CRITICAL Act Now

Improper Handling of Length Parameter Inconsistency in GitHub repository francoisjacquet/rosariosis prior to 10.0. Rated

CVE-2022-3072 MEDIUM This Month POC

Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 8.9.3. Rated medium severit

CVE-2022-2036 MEDIUM This Month POC

Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.1. Rated medium severit

CVE-2022-1997 MEDIUM This Month POC

Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0. Rated medium severity

CVE-2023-2665 HIGH This Week

Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to

CVE-2023-2202 MEDIUM This Month

Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3. Rated medium severity (CVSS 6.5

Same weakness CWE-1236 – Improper Neutralization of Formula Elements in a CSV File

View all

CVE-2019-14749 HIGH POC

CVE-2020-36962 CRITICAL POC

CVE-2023-46401 CRITICAL POC

CVE-2025-56267 CRITICAL POC

CVE-2021-47901 CRITICAL POC

CVE-2020-36941 CRITICAL POC

CVE-2022-3574 CRITICAL POC

CVE-2022-3463 CRITICAL POC

Same technique Code Injection

View all

CVE-2012-0158 HIGH POC

CVE-2014-6287 CRITICAL POC

CVE-2017-7494 CRITICAL POC

CVE-2025-24893 CRITICAL POC

CVE-2025-47812 CRITICAL POC

CVE-2013-3906 HIGH POC

CVE-2017-9822 HIGH POC

CVE-2018-1273 CRITICAL POC

Share

CVE-2023-29918 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy