Ericsson Network Manager (ENM), versions prior to 22.1, contains a vulnerability in the application Network Connectivity Manager (NCM) where improper Neutralization of Formula Elements in a CSV File can lead to remote code execution or data leakage via maliciously injected hyperlinks. The attacker would need admin/elevated access to exploit the vulnerability.
References
| Link | Resource |
|---|---|
| https://www.gruppotim.it/it/footer/red-team.html | Third Party Advisory |
Configurations
History
06 Jul 2023, 19:22
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.8 |
| First Time |
Ericsson
Ericsson network Manager |
|
| CWE | CWE-1236 | |
| CPE | cpe:2.3:a:ericsson:network_manager:*:*:*:*:*:*:*:* | |
| References | (MISC) https://www.gruppotim.it/it/footer/red-team.html - Third Party Advisory |
29 Jun 2023, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-29 03:15
Updated : 2023-07-06 19:22
NVD link : CVE-2022-46408
Mitre link : CVE-2022-46408
JSON object : View
Products Affected
ericsson
- network_manager
CWE
CWE-1236
Improper Neutralization of Formula Elements in a CSV File