Incorta CSV Injection Vulnerability in Edit Insight Handler

A CSV injection vulnerability has been identified in Incorta version 2023.4.3. The issue arises in the Edit Insight Handler component, where an unknown function improperly handles the Service Name argument, allowing for remote exploitation. The vulnerability was disclosed to the vendor, but no response was received.

Impact

Exploitation of this vulnerability allows for CSV injection, where an attacker can manipulate the output of a CSV file to execute malicious commands or scripts when the file is opened.