VulnerabilityPublished 9 Nov 2023Updated 29 Sep 2025

CVE-2023-47489: CSV Injection in Export as Csv

Source CVE Database V5

Not known to be exploited.

Data as of 26 Oct 2026, 16:39 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.4% chance of exploitation in 30 days – higher than 38% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 9 Nov 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

Immediate mitigation should include restricting access to the export functionality to trusted users only and monitoring export activities for suspicious behavior.
Educate users to avoid opening CSV files from untrusted or unexpected sources, especially those generated by iTop exports.
Implement input sanitization or escaping of special characters (such as '=', '+', '-', '@') in CSV exports to neutralize formula injection vectors.
If possible, disable CSV export temporarily until a patch is available.
Monitor Combodo's official channels for patches or updates addressing this vulnerability and apply them promptly once released.
Employ endpoint protection solutions that can detect and block malicious macro or script execution triggered from spreadsheet applications.
Review and enforce strict user privilege management to minimize local attacker capabilities.
Consider alternative export formats that do not support formula execution, such as plain text or JSON, if supported by the application.

Description

CSV injection in export as csv in Combodo iTop v.3.1.0-2-11973 allows a local attacker to execute arbitrary code via a crafted script to the export-v2.php and ajax.render.php components.

Impact

For European organizations using Combodo iTop, this vulnerability poses a risk of arbitrary code execution on systems of users who open maliciously crafted CSV exports. This can lead to compromise of user machines, potential lateral movement within the network, and exposure of sensitive IT management data. Given that iTop is often used in IT service management, exploitation could undermine operational integrity and confidentiality of IT asset data. The local attacker requirement limits remote exploitation but insider threats or compromised local accounts could leverage this vulnerability. The impact is heightened in environments where exported CSV files are shared widely or opened without sufficient caution. Additionally, organizations with strict data governance and compliance requirements in Europe (such as GDPR) could face regulatory consequences if data integrity or confidentiality is breached due to this vulnerability. The absence of known exploits reduces immediate risk but does not eliminate the threat, especially as attackers may develop exploits once the vulnerability details are public.

References

Community reviews

Loading reviews…