Nokia Impact Improper Neutralization of Formula Elements Vulnerability in Campaign Export Function

A vulnerability allowing for improper neutralization of formula elements in CSV exports has been identified in Nokia Impact versions prior to Mobile 23_FP1. This issue arises in Impact DM 19.11 and later, where a remote authenticated user can inject malicious payloads into the Campaign Name while using the Add Campaign feature. The injected data can be exported to a CSV file, potentially leading to data exfiltration or other malicious activities when the file is opened with spreadsheet software.

Impact

Exploitation of this vulnerability could result in command injection, allowing attackers to execute arbitrary commands on the affected system.