Apache Directory Studio Command Injection

HIGH 7.8CVE-2015-5349 · GHSA-p9qj-4rjp-j3w9 · Published 11/04/2016 · updated 17/06/2026

In short

CVE-2015-5349 is a HIGH (CVSS 7.8) vulnerability affecting org.apache.directory.studio:org.apache.directory.studio.ldapbrowser.core, directory studio (apache), ldap studio (apache).
Chance of exploitation in the next 30 days (EPSS): 2.1%, higher than 81.9% of all vulnerabilities.
Fix: update to 2.0.0.v20151221-M10 or later.

Package	Affected versions	Patched versions
org.apache.directory.studio:org.apache.directory.studio.ldapbrowser.core Maven	`< 2.0.0.v20151221-M10`	`2.0.0.v20151221-M10`
directory studio apache	`= 1.0.0= 1.0.1= 1.1.0= 1.2.0= 1.3.0= 1.4.0= 1.5.0= 1.5.1= 1.5.2= 1.5.3= 2.0.0`	No fix yet
ldap studio apache	`= 0.6.0= 0.7.0= 0.8.0= 0.8.1`	No fix yet

Description

The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow attackers to execute arbitrary commands by leveraging a crafted LDAP entry that is interpreted as a formula when imported into a spreadsheet.

NVD description

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free