Cyber Resilience

CVE-2021-38180

Critical

Published: 12 October 2021

Published
12 October 2021
Modified
24 February 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0128 80.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-38180 is a critical-severity Improper Neutralization of Formula Elements in a CSV File (CWE-1236) vulnerability in Sap Business One. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 20.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitation during the data export. An attacker could thereby execute arbitrary commands on the victim's computer but only…

more

if the victim allows to execute macros while opening the file and the security settings of Excel allow for command execution.

CWE(s)
CWE-1236

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

sap
business one
10.0

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References