Untriaged
Permalink
CVE-2021-47901
9.8 CRITICAL
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): HIGH
- Availability impact (A): HIGH
dirsearch 0.4.1 - CSV Injection
Dirsearch 0.4.1 contains a CSV injection vulnerability when using the --csv-report flag that allows attackers to inject formulas through redirected endpoints. Attackers can craft malicious server redirects with comma-separated paths containing Excel formulas to manipulate the generated CSV report.
References
- ExploitDB-49370 exploit
- dirsearch GitHub Repository product
- VulnCheck Advisory: dirsearch 0.4.1 - CSV Injection third-party-advisory
- VulnCheck Advisory: dirsearch 0.4.1 - CSV Injection third-party-advisory
- ExploitDB-49370 exploit
- dirsearch GitHub Repository product
- ExploitDB-49370 exploit
- dirsearch GitHub Repository product
- VulnCheck Advisory: dirsearch 0.4.1 - CSV Injection third-party-advisory
Affected products
dirsearch
- ==0.4.1
Matching in nixpkgs
pkgs.python312Packages.dirsearch
Command-line tool for brute-forcing directories and files in webservers, AKA a web path scanner
pkgs.python313Packages.dirsearch
Command-line tool for brute-forcing directories and files in webservers, AKA a web path scanner
Package maintainers
-
@quantenzitrone quantenzitrone <nix@dev.quantenzitrone.eu>