{"id":"CVE-2018-15474","details":"CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins/usermanager/admin.php in DokuWiki 2018-04-22a and earlier allows remote attackers to exfiltrate sensitive data and to execute arbitrary code via a value that is mishandled in a CSV export.  NOTE: the vendor has stated \"this is not a security problem in DokuWiki.","modified":"2026-07-08T17:15:43.188232Z","published":"2018-09-07T22:29:00.977Z","references":[{"type":"WEB","url":"https://www.patreon.com/posts/unfixed-security-21250652"},{"type":"REPORT","url":"https://github.com/splitbrain/dokuwiki/issues/2450"},{"type":"EVIDENCE","url":"https://seclists.org/fulldisclosure/2018/Sep/4"},{"type":"EVIDENCE","url":"https://www.sec-consult.com/en/blog/advisories/dokuwiki-csv-formula-injection-vulnerability/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/dokuwiki/dokuwiki","events":[{"introduced":"0"},{"last_affected":"504b44a4c7fde212be653fc640f1685318449287"}],"database_specific":{"cpe":"cpe:2.3:a:dokuwiki:dokuwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"2018-04-22a"}],"source":"CPE_RANGE"}}],"versions":["release-2018-04-22c","release-2018-04-22b","release-2018-04-22a","release-2018-04-22","release-2017-02-19e","release-2017-02-19d","release-2017-02-19c","release-2017-02-19b","release-2017-02-19a","release-2017-02-19","release-2016-06-26a","release-2016-06-26","release-2015-08-10a","release-2015-08-10","release-2014_09_29d","release-2014_09_29c","release-2014_09_29b","release-2014-09-29a","release-2014-09-29","release-2014-05-05a","release-2014-05-05","release-2013-12-08","release-2013-11-18rc","release-2013-10-28rc","release-2013-05-10a","release-2013-05-10","release-2013_03_06rc","release-2012-10-13","release-2012_09_10rc","release-2012-01-25b","release-2012-01-25","release-2011-11-10rc","release-2011_05_25a","release-2010-11-07a","release-2011_05_25","release-2010-11-07","release-2010-10-27rc","release-2010-10-07rc","release-2009-12-25","release-2009-12-02rc","release-2009-02-14","release-2009-02-06rc","release-2009-01-30rc","release-2009-01-26rc","release-2008-05-05","release-2008-05-04","release-2008-04-11rc","release-2008-03-31rc","release-2007-06-26","release-2007-05-24rc","release-2006-11-06","release-2006-10-19rc","release-2006-10-08rc","release-2006-09-28rc","release-2006-03-09","release-2006-03-05","release-2005-09-22","release-2005-09-19","release-2005-07-13","release-2005-07-01"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-15474.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}]}