1. Home
  2. CVE Database
  3. CVE-2020-22390
HIGH · 8.8

CVE-2020-22390

Akaunting <= 2.0.9 is vulnerable to CSV injection in the Item name field, export function. Attackers can inject arbitrary code into the name parameter and perform code execution when the crafted file ...

Vulnerability Description

Akaunting <= 2.0.9 is vulnerable to CSV injection in the Item name field, export function. Attackers can inject arbitrary code into the name parameter and perform code execution when the crafted file is opened.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
AkauntingAkaunting<= 2.0.9

Related Weaknesses (CWE)

CWE-1236

References

FAQ

What is CVE-2020-22390?

CVE-2020-22390 is a vulnerability with a CVSS score of 8.8 (HIGH). Akaunting <= 2.0.9 is vulnerable to CSV injection in the Item name field, export function. Attackers can inject arbitrary code into the name parameter and perform code execution when the crafted file ...

How severe is CVE-2020-22390?

CVE-2020-22390 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-22390?

Check the references section above for vendor advisories and patch information. Affected products include: Akaunting Akaunting.