Read the docs
TI-2015-04503 Aliases CVE-2015-5349GHSA-p9qj-4rjp-j3w9

The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does…

Priority LOW 38CWE-77Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow attackers to execute arbitrary commands by leveraging a crafted LDAP entry that is interpreted as a formula when imported into a spreadsheet.

Why it matters now

EPSS 0.02109 81st percentileScored 2026-11-07
Fix Fixed org.apache.directory.studio:org.apache.directory.studio.ldapbrowser.core (Maven): 2.0.0.v20151221-M10

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.directory.studio:org.apache.directory.studio.ldapbrowser.core (Maven)before 2.0.0.v20151221-M102.0.0.v20151221-M10Patch availableGHSA-p9qj-4rjp-j3w9
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.directory.studio:org.apache.directory.studio.ldapbrowser.core (Maven) Vendor— Affected before 2.0.0.v20151221-M10 Fixed in 2.0.0.v20151221-M10 Patch available GHSA-p9qj-4rjp-j3w9

CPE configurations NVD · 27

CPEVersionsRoleVendor
cpe:2.3:a:apache:ldap_studio:0.6.0:*:*:*:*:*:*:*0.6.0VulnerableApache
cpe:2.3:a:apache:ldap_studio:0.7.0:*:*:*:*:*:*:*0.7.0VulnerableApache
cpe:2.3:a:apache:ldap_studio:0.8.0:*:*:*:*:*:*:*0.8.0VulnerableApache
cpe:2.3:a:apache:ldap_studio:0.8.1:*:*:*:*:*:*:*0.8.1VulnerableApache
cpe:2.3:a:apache:directory_studio:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableApache
cpe:2.3:a:apache:directory_studio:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableApache
cpe:2.3:a:apache:directory_studio:1.1.0:*:*:*:*:*:*:*1.1.0VulnerableApache
cpe:2.3:a:apache:directory_studio:1.1.0:rc1:*:*:*:*:*:*1.1.0 rc1VulnerableApache
cpe:2.3:a:apache:directory_studio:1.1.0:rc2:*:*:*:*:*:*1.1.0 rc2VulnerableApache
cpe:2.3:a:apache:directory_studio:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableApache
  • cpe:2.3:a:apache:ldap_studio:0.6.0:*:*:*:*:*:*:* Versions 0.6.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:ldap_studio:0.7.0:*:*:*:*:*:*:* Versions 0.7.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:ldap_studio:0.8.0:*:*:*:*:*:*:* Versions 0.8.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:ldap_studio:0.8.1:*:*:*:*:*:*:* Versions 0.8.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:1.1.0:rc1:*:*:*:*:*:* Versions 1.1.0 rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:1.1.0:rc2:*:*:*:*:*:* Versions 1.1.0 rc2 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Apache
Show 17 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:directory_studio:1.2.0:rc1:*:*:*:*:*:*1.2.0 rc1VulnerableApache
cpe:2.3:a:apache:directory_studio:1.3.0:*:*:*:*:*:*:*1.3.0VulnerableApache
cpe:2.3:a:apache:directory_studio:1.3.0:rc1:*:*:*:*:*:*1.3.0 rc1VulnerableApache
cpe:2.3:a:apache:directory_studio:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableApache
cpe:2.3:a:apache:directory_studio:1.5.0:*:*:*:*:*:*:*1.5.0VulnerableApache
cpe:2.3:a:apache:directory_studio:1.5.1:*:*:*:*:*:*:*1.5.1VulnerableApache
cpe:2.3:a:apache:directory_studio:1.5.2:*:*:*:*:*:*:*1.5.2VulnerableApache
cpe:2.3:a:apache:directory_studio:1.5.3:*:*:*:*:*:*:*1.5.3VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone1:*:*:*:*:*:*2.0.0 milestone1VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone2:*:*:*:*:*:*2.0.0 milestone2VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone3:*:*:*:*:*:*2.0.0 milestone3VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone4:*:*:*:*:*:*2.0.0 milestone4VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone5:*:*:*:*:*:*2.0.0 milestone5VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone6:*:*:*:*:*:*2.0.0 milestone6VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone7:*:*:*:*:*:*2.0.0 milestone7VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone8:*:*:*:*:*:*2.0.0 milestone8VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone9:*:*:*:*:*:*2.0.0 milestone9VulnerableApache
  • cpe:2.3:a:apache:directory_studio:1.2.0:rc1:*:*:*:*:*:* Versions 1.2.0 rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:1.3.0:rc1:*:*:*:*:*:* Versions 1.3.0 rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:1.5.2:*:*:*:*:*:*:* Versions 1.5.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:1.5.3:*:*:*:*:*:*:* Versions 1.5.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone1:*:*:*:*:*:* Versions 2.0.0 milestone1 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone2:*:*:*:*:*:* Versions 2.0.0 milestone2 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone3:*:*:*:*:*:* Versions 2.0.0 milestone3 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone4:*:*:*:*:*:* Versions 2.0.0 milestone4 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone5:*:*:*:*:*:* Versions 2.0.0 milestone5 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone6:*:*:*:*:*:* Versions 2.0.0 milestone6 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone7:*:*:*:*:*:* Versions 2.0.0 milestone7 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone8:*:*:*:*:*:* Versions 2.0.0 milestone8 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone9:*:*:*:*:*:* Versions 2.0.0 milestone9 Vulnerable ·Apache

Remediation

  • Fix · GHSA-p9qj-4rjp-j3w9 org.apache.directory.studio:org.apache.directory.studio.ldapbrowser.core (Maven) Fixed in 2.0.0.v20151221-M10 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat build of OpenJDK 11

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-5349
  2. 2026-10-03 Alias added: GHSA-p9qj-4rjp-j3w9

References

Advisory 2

Other 5

  • TI-2021-13214 StartTLS and SASL confidentiality protection bypass CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences