CVE-2021-40848

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interpret as a command, leading to execution of a malicious string locally on a device, aka CSV injection.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1236

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.launchpad.net/mahara/+bug/1930471Vendor Advisory
https://mahara.org/interaction/forum/topic.php?id=8950Vendor Advisory
https://bugs.launchpad.net/mahara/+bug/1930471Vendor Advisory
https://mahara.org/interaction/forum/topic.php?id=8950Vendor Advisory

Timeline

Published: Nov 3, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-408499.8In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited a CVE-2021-408509.8TCMAN GIM is vulnerable to a SQL injection vulnerability inside several available webservice methods in /PC/WebService.asmx.CVE-2021-408517.5TCMAN GIM is vulnerable to a lack of authorization in all available webservice methods listed in /PC/WebService.asmx. The exploitation of th CVE-2021-408526.1TCMAN GIM is affected by an open redirect vulnerability. This vulnerability allows the redirection of user navigation to pages controlled by CVE-2021-408537.2TCMAN GIM does not perform an authorization check when trying to access determined resources. A remote attacker could exploit this vulnerabi CVE-2021-408547.8AnyDesk before 6.2.6 and 6.3.x before 6.3.3 allows a local user to obtain administrator privileges by using the Open Chat Log feature to lau CVE-2021-408559.8The EU Technical Specifications for Digital COVID Certificates before 1.1 mishandle certificate governance. A non-production public key cert CVE-2021-408567.5Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring.CVE-2021-408578.8Auerswald COMpact 5500R devices before 8.2B allow Privilege Escalation via the passwd=1 substring.CVE-2021-408584.9Auerswald COMpact 5500R devices before 8.2B allow Arbitrary File Disclosure. A sub-admin can read the cleartext Admin password via the fileN CVE-2021-408599.8Backdoors were discovered in Auerswald COMpact 5500R 7.8A and 8.0B devices, that allow attackers with access to the web based management app CVE-2021-408607.2A SQL Injection in the custom filter query component in Genesys intelligent Workload Distribution (IWD) before 9.0.013.11 allows an attacker